Skip to content

SPF Record Checker

The SPF Checker analyses and validates the SPF (Sender Policy Framework) records for your domains. It helps identify configuration issues that could affect email deliverability and DMARC compliance.

Purpose

The SPF Checker evaluates your SPF records to detect common configuration errors and provides actionable recommendations. SPF works by creating a DNS record listing the mail servers authorised to send emails on behalf of your domain, helping prevent email spoofing.

Use this tool to:

  • Check all your domains have SPF records setup
  • Verify that your SPF records are correctly formatted
  • Identify DNS lookup limit issues
  • Detect configuration errors that may affect deliverability
  • Get specific recommendations for improvement

Note: While SPF is one authentication method for DMARC compliance, many services do not align the return-path and Header From. Adding these services to your SPF record is redundant.

Key Points

  • SPF records must follow strict syntax rules to be effective
  • SPF records have a limit of 10 DNS lookups which must not be exceeded
  • SPF records of mail sending domains should end in ~all (softfail) not -all (fail)
    • This is to ensure mail is not prematurely rejected before DKIM is evaluated
  • Common issues include syntax errors and lookup limit violations

Checker Functionality

The SPF Checker provides:

  • Record Validation: Confirms your SPF record follows correct syntax and best practice
  • DNS Lookup Count: Tracks the number of DNS lookups your record requires
  • Record Expansion: Shows the fully expanded SPF record after resolving all includes
  • Observed Usage: Shows which parts of your record have been matched by real email traffic

Observed Usage

Over time, SPF records tend to accumulate entries for services that are no longer in use. Each stale entry consumes DNS lookups and widens the set of servers allowed to send on your behalf. Observed Usage helps you find these candidates for cleanup.

The Observed column shows how much of each SPF record has been matched by real email traffic reported for your domain over the last 90 days, for example "3 of 9". A dash means there is no usage data for the domain yet, or no traffic has been observed in the window. Sort by the Observed column to surface records worth reviewing.

In the expanded record view, each part of the record is shown according to its observed usage and the 10 DNS lookup limit:

  • Green entries (with a checkmark icon) have been matched by observed traffic and sit within the lookup limit.
  • Red entries (with an exclamation icon) have been matched by observed traffic, but evaluating them can take a check past the 10 DNS lookup limit. Receivers that enforce the limit can fail these checks, so this mail is at risk until the record is brought under the limit. Resolve these first.
  • Gold entries are past the lookup limit with no observed traffic. Receivers that enforce the limit may never credit these entries, so this is not reliable evidence the entry is unused.
  • Standard entries could authorise mail but have not been observed in the window.
  • Dimmed parts are record syntax that is not part of the usage count, such as v=spf1 and the trailing all mechanism.

Icons appear only on entries with observed traffic, so the chip states remain distinguishable without relying on colour alone.

Important:

  • An entry without observed traffic is not automatically safe to remove. Low-volume, seasonal, or failover senders may not send during the 90-day window, and some services send only for specific workflows (e.g. password resets, invoices).
  • Usage is based on the aggregate reports VerifyDMARC receives for your domains; very small volumes may not be represented.
  • Always confirm with the service owner before removing an entry from your SPF record, and recheck the record after DNS changes propagate.

Issue Detection

The checker identifies common SPF configuration issues:

  • Missing Records: When a domain has no SPF record
  • Syntax Errors: Invalid formatting or directives
  • Lookup Limit Violations: Configurations that exceed the 10 lookup limit; the expanded record view shows which entries fall past the limit (see Observed Usage)
  • Inconsistent Configuration: Conflicting mechanisms or incomplete coverage
  • Common Mistakes: Identifies frequently seen misconfigurations

Recommendations

Based on the analysis, the SPF Checker provides:

  • Specific Fixes: Actionable suggestions to resolve identified issues
  • Best Practice Guidelines: Recommendations aligned with email authentication standards

Using the Checker

  1. Review Analysis: Check domains with an Error or Warning result
  2. Apply Recommendations: Implement the suggested changes to your DNS records
  3. Recheck: After waiting for DNS changes to propagate, check the report again