Daniel Lasek · Last reviewed 2026-11-01
SPF Record Checker: how it works and what to fix
SPF (Sender Policy Framework) is a single TXT record that lists the servers allowed to send email for your domain. This checker reads it, checks every part of the syntax, follows each include to count the DNS lookups receivers will make, and gives you a corrected record to paste back. DMARC and DKIM are checked at the same time; the full picture is on the Email Security Checker.
How to read an SPF record
Take v=spf1 include:_spf.google.com ip4:203.0.113.10 ~all:
v=spf1marks it as SPF. It must come first, and there must be only one such record.include:_spf.google.comallows every server Google lists in its own SPF record.ip4:203.0.113.10allows one specific server, for example your web server.~allsays "anything else is probably not us" (soft fail).
The other mechanisms are a (the domain's own A record), mx (your inbound mail servers), ip6, exists and the deprecated ptr. redirect= hands the whole decision to another domain's record.
The endings, ranked
-all: hard fail. Unlisted servers fail SPF. Strict and fine once every sender is listed.~all: soft fail. The usual choice, and safe when DMARC does the enforcing.?all: neutral. Says nothing, protects nothing.+all: pass. Every server on earth may send as you. Spammers scan for this.- No
allat all: treated as neutral.
The four mistakes we see most
Two records. Someone adds a record for a new newsletter tool instead of editing the existing one. Both are now ignored, and SPF fails everywhere. Merge them into one.
Over 10 lookups. Each include can hide several more. The checker shows the whole tree with the cost of each branch so you can see what to cut. After 10, receivers give up with a permerror.
Dead includes. A service you cancelled years ago, or a typo like include:_spf.gogle.com. A name that returns nothing is a "void lookup"; more than two of them also breaks SPF.
Authorising the web server without thinking. a or your host's include lets your web server send as your domain. That is how WordPress contact forms work on many hosts, but it also means spam sent by malware on a hacked site passes SPF under your name. If you can, send WordPress mail through your mail provider with an SMTP plugin and drop the web server from SPF. If mail problems started suddenly, run the free Laskyr scan as well.
Where to put the record
Add a TXT record with host @ (the bare domain) in the DNS panel where your domain's nameservers point: your registrar, Cloudflare, or your host's cPanel Zone Editor. In Cloudflare, SPF is just a TXT record; there is no proxy setting for it. Changes usually show within minutes, sometimes a few hours.
Questions
What does SPF permerror mean?
It means receivers could not evaluate your SPF record at all, so SPF fails for every message. The usual causes are two SPF records on the same domain, a typo in a mechanism, more than 10 DNS lookups, or an include that points to a domain with no SPF record.
Can I have two SPF records if I use two email services?
No. A domain may publish exactly one record starting with v=spf1. Put both services in one record, for example v=spf1 include:_spf.google.com include:sendgrid.net ~all.
Which mechanisms count toward the 10-lookup limit?
include, a, mx, ptr, exists and the redirect modifier each cost one lookup, including the ones inside records you include. ip4, ip6 and all cost nothing.
How do I get under 10 lookups?
Remove includes for services you stopped using, replace a and mx with the ip4 addresses they resolve to, and move bulk senders such as newsletter tools to a subdomain with its own SPF record. Flattening services can rewrite includes into IP lists, but they need to keep the list up to date.
Does SPF need to be on the www subdomain too?
SPF is checked for the domain in the envelope sender (Return-Path), and the result counts for DMARC only when that domain matches your From domain. Publish it on the domain you send from, usually the bare domain. A subdomain used for sending, like mail.example.com, needs its own record.