How do I check if my SPF record is valid?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
A valid SPF record has to clear a handful of very specific checks: exactly one record, correct syntax, under the 10-lookup cap, and an "all" qualifier that makes sense for your setup. Miss any one of them and receivers will either fail SPF or throw a permerror.
You've got two ways to check. One takes 10 seconds. The other takes a couple of minutes and shows you more.
The 10-second version: paste it into a checker
Drop your domain into our SPF checker. It'll tell you:
- Whether you have exactly one SPF record (more than one is a permerror)
- Whether it starts with
v=spf1 - How many DNS lookups it triggers (has to stay under 10)
- Which mechanisms are there and whether each one resolves cleanly
- What "all" qualifier you're publishing (
-all,~all, or?all)
If any of those show red, the checker tells you what to fix. This is how most people should do it.
The command line version: dig
If you live in a terminal, you can query DNS yourself:
dig TXT yourdomain.com +shortLook for the line that starts with "v=spf1". That's your SPF record. Things to verify:
- Exactly one v=spf1 line. If you see two, consolidate them immediately. Two records is an automatic permerror.
- Syntax is right. Mechanisms should be
include:,a,mx,ip4:,ip6:,exists:,ptr, separated by spaces. - Ends with an all mechanism.
-allfor production,~allwhile you're auditing,?allalmost never.
What "valid" looks like
And a clean production SPF for a domain using Google Workspace and one ESP might look like:
v=spf1 include:_spf.google.com include:_spf.yourESP.com -allShort. One record. Under 10 lookups. Hard fail at the end. That's the shape you want.
If the checker flags something and you're not sure how to interpret the result, the SOS hotline is free.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
