Skip to content

Does your SPF record stop spoofing?

Enter a domain to see whether it publishes an SPF record, whether that record is valid, and whether it actually limits who can send as the domain.

Last reviewed

Reads public DNS now. Nothing is stored.

SPF lists who may send as your domain.

SPF (RFC 7208) is a TXT record on your domain that lists the servers allowed to send mail for it. Receivers compare the sending server with the list, left to right, and the all at the end decides what happens to everyone else. That ending is most of what a scan reports:

How the end of an SPF record is scored
Example record: v=spf1 include:_spf.example.net ~all
  1. +allHigh80
  2. No allMedium45
  3. ?allNo finding
  4. ~allNo finding
  5. -allNo finding

The check looks at three things: whether a record exists, whether the domain publishes more than one, and how the record ends.

Five outcomes, four of them findings.

What the scan findsFindingSeverity
No SPF recordSPF record missingMedium60
More than one SPF record on the domainSPF record invalidMedium50
The record ends in +all, or a bare allSPF authorises all sendersHigh80
The record has no all and no redirectSPF record has no all mechanismMedium45
The record ends in ~all, -all or ?allNo SPF finding

Severity runs from 0 to 100. +all scores highest because it authorises every server on the internet while the record looks configured. A missing all leaves receivers with no instruction, which in practice gives no protection. Two SPF records on one domain are invalid: receivers return an error and most then ignore SPF for the domain.

End the record with ~all or -all.

  • ~all suits most domains that send mail. Unlisted servers get a softfail, and DMARC makes the final decision.
  • -all suits domains that never send mail, and sending domains where every sender is known.
  • ?all raises no finding in the scan, but it makes no statement about unlisted servers and protects no better than a record without all. Change it to ~all or -all.

A parked domain that never sends mail should say so:

example.org.  3600  IN  TXT  "v=spf1 -all"

Some limits need checking by hand.

  • The ten-lookup limit. RFC 7208 allows at most ten DNS lookups when evaluating a record, counting every include and everything inside it. The full scan does not follow includes or count lookups, so a record over the limit is not flagged there. The lookup at the top of this page does count them, through every include; the SPF guide shows the ways to stay under ten.
  • Alignment. A service can pass SPF for its own bounce domain and still fail DMARC for yours. The scan reads your record, not how each sender uses it.
  • One reading at one point in time, of the domain you enter. Subdomains you send from need their own records.

“No finding” means the record exists, is not duplicated and ends in a way that limits senders. It does not prove every legitimate sender is listed, or that the domain cannot be spoofed.

SPF works together with DMARC.

SPF on its own tells receivers which servers are allowed. DMARC tells them what to do when a message fails, and requires SPF or DKIM to pass in alignment with the From address. Check both: the DMARC check explains the DMARC results, and the guide How to move DMARC from p=none to p=reject takes you to enforcement.

SPF is a small part of the full scan.

SPF is one part of the email security module, which also reads DMARC, DKIM, MTA-STS, TLS reporting, CAA, DNSSEC and nameserver redundancy. The full check covers all six modules in one scan of about 30 seconds.

The methodology explains how findings become a score.

Read the SPF guideRun the full free check

Sources