SPF Record Checker: How to Check Your SPF Record and Read the Results

SPF (Sender Policy Framework) is a TXT record on your domain that lists which services may send email as you. If it's missing, duplicated, or broken, your invoices and newsletters are more likely to land in spam, and someone else can send mail that looks like it came from you. Here's how to check it and what each result means.

Step 1: Look up the record

SPF lives on the exact domain your mail is sent from, usually your root domain (not www). From a terminal:

dig +short TXT yourdomain.com

On Windows:

nslookup -type=TXT yourdomain.com

Find the string that starts with v=spf1. A healthy result looks like this:

"v=spf1 include:_spf.google.com include:sendgrid.net ~all"

Step 2: Read what you found

What you see	What it means
No `v=spf1` string at all	No SPF record. Receivers can't verify any of your mail.
Two or more `v=spf1` strings	A permanent error (permerror). Receivers ignore both. Merge them into one.
Ends in `~all`	Soft fail: unlisted senders are marked suspicious. Fine while you're still finding all your senders.
Ends in `-all`	Hard fail: unlisted senders should be rejected. Strongest, once every sender is listed.
Ends in `+all` or `?all`	Anyone may send as you. This defeats the purpose; change it.

Step 3: Count your DNS lookups

The SPF standard (RFC 7208, section 4.6.4) caps evaluation at 10 DNS-querying terms. Go over and receivers return permerror, which DMARC treats as a fail. What counts:

Counts: include, a, mx, ptr, exists, and redirect.
Doesn't count: ip4, ip6, and all.
Nested includes count too. An include that points to a record with three more includes costs four lookups, not one.

To count by hand, look up each include: target (for example dig +short TXT _spf.google.com) and keep following includes until none are left. Large, well-run domains often sit right at 10, so adding "just one more" marketing tool is the classic way to break SPF.

How to fix the common failures

Too many lookups: remove includes for tools you no longer send from, drop mx if your inbound mail servers don't send mail, remove ptr entirely (the RFC says it shouldn't be published), or move bulk mail to a subdomain like news.yourdomain.com, which gets its own 10-lookup budget.
Duplicate records: combine them. v=spf1 include:_spf.google.com ~all plus v=spf1 include:servers.mcsv.net ~all becomes v=spf1 include:_spf.google.com include:servers.mcsv.net ~all.
Flattening with caution: replacing includes with IP addresses lowers the count, but providers change their IPs. Microsoft specifically says not to flatten spf.protection.outlook.com. Try the options above first.

After you change it

Re-run the lookup until you see exactly one v=spf1 string. Most DNS hosts update within an hour, though Google says to allow 24 to 48 hours. Then send yourself a test email in Gmail, open Show original, and confirm it says SPF: PASS. SPF alone doesn't stop spoofing of your visible From address, so pair it with a DMARC record (see our DMARC checker guide). Need provider steps? We have guides for Cloudflare and GoDaddy.

Check it the fast way

Want the answer without the terminal? Scan your site free with SiteShield. It checks your SPF, DMARC, HTTPS, and security headers in under a minute and shows your score and every issue found. If you'd rather skip the trial and error, the $14 fix bundle gives you copy-paste fixes written for your exact site.

Check your site free

SiteShield by Telekeen · Telekeen Communications