SPF Record Checker
Why is my email going to spam?
Check your SPF record to see which services may send email for your domain, how close you are to the 10 DNS lookup limit and which errors void the record, all on one screen.
Create an SPF Record
Tick every service that sends email with your domain, then copy the one-line record into your DNS panel as a TXT record. Delete the old SPF record: a domain may have only one.
Email Going to Spam? SPF Problems and Fixes
SPF trouble usually comes from one mistake: a new service created a second SPF record, the includes went over the 10-lookup limit, or the service you send from isn't in the record. Pick the symptom you see.
My sent email lands in spam
First check the record exists, then the "recognised services" list in the result: if the service you send through (email provider, newsletter tool, CRM, invoicing software) isn't there, receivers can't verify that mail. Add the missing service's include to the existing record, then check DKIM and DMARC as well.
Create an SPF record"SPF permerror" or "too many DNS lookups"
SPF evaluation may use at most 10 DNS lookups; include, a, mx, ptr, exists and redirect each count as one, and lookups inside includes add up too. Remove includes for services you no longer use and write ip4/ip6 for servers with fixed IPs. Track the count in the result's counter and include chain.
My domain has two SPF records
Two separate v=spf1 records void SPF entirely. Merge their mechanisms into one record, for example v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all, then delete the extra record.
Should I use ~all or -all?
~all has mail from unlisted servers marked suspicious; -all has it rejected. If you're not sure your list of senders is complete, start with ~all and switch to -all once DMARC reports show every legitimate sender passing.
SPF fails on forwarded email
When an email is forwarded, the forwarding server becomes the sender and its IP isn't in your SPF. That's a known SPF limitation; a DKIM signature survives forwarding and keeps the message verifiable.
DKIM Record CheckerSPF passes but DMARC fails
DMARC needs SPF to pass for your domain (alignment). If a newsletter or CRM service sends with its own domain, SPF passes for theirs, not yours. Turn on sending with your own domain in that service (custom return path or DKIM).
DMARC Record CheckerWhat Is an SPF Record?
SPF (Sender Policy Framework) is a TXT record listing the servers allowed to send email for your domain. The receiving server compares the sending IP address with this list; if the address isn't on it, the message is treated as suspicious or rejected.
A domain can have only one SPF record, and evaluating it may take at most 10 DNS lookups (RFC 7208). A second record, or an include chain over the limit, voids SPF entirely, so the record should be re-checked as it grows.
- Sending serverSends the message from its IP address
- SPF recordLists the servers that are allowed
- Receiving serverDecides pass, suspicious or reject
How to Read an SPF Record
v=spf1Version: Marks the record as SPF; every SPF record starts with it, exactly once.include:_spf.google.cominclude: Adds another domain's SPF list, here Google Workspace's servers. Each include counts as one DNS lookup.ip4:203.0.113.10ip4: Allows sending from this IPv4 address (or a range such as /24) and needs no DNS lookup.mxmx: Lets the domain's MX servers send; counts as one DNS lookup.~allDefault rule: The decision for servers not listed:~suspicious,-reject. It goes at the end of the record.
The result also explains every term, names the services behind each include and shows the count against the 10-lookup limit.
SPF Values for Popular Email Services
Add the value of each service you use to the same v=spf1 record; don't create a separate record per service.
| Service | Value to add to SPF |
|---|---|
| MailLB (Atak Domain) | ip4:185.46.40.0/22 |
| Google Workspace | include:_spf.google.com |
| Microsoft 365 | include:spf.protection.outlook.com |
| Yandex 360 | include:_spf.yandex.net |
| Zoho Mail | include:zohomail.com |
| Proton Mail | include:_spf.protonmail.ch |
For newsletter, CRM or invoicing services, the value is shown in the service's domain verification screen. You can confirm it still works by checking the include chain with this tool.
Frequently Asked Questions
The most common questions about SPF records, the 10-lookup limit and spam problems.
- SPF tells receiving servers which servers may send email for your domain. When someone else tries to send with your domain, the message is flagged or rejected, while your own mail stays out of spam.
- No. With two separate
v=spf1records SPF returns a permerror and doesn't work at all. Combine the values of all your services in one record. - When evaluating SPF, the receiver makes at most 10 DNS lookups for include, a, mx, ptr, exists and redirect, including those nested inside includes. Over the limit, SPF returns a permerror. Removing unused includes and writing ip4/ip6 for fixed IPs is the safest fix.
-
~all(softfail) has mail from unlisted servers marked suspicious;-all(fail) has it rejected. In practice most receivers act on your DMARC policy; if your sender list is complete, -all protects more strictly. - In the panel where you manage your domain's DNS, create a TXT record with
@(or your domain) as the name and a value starting withv=spf1and ending with~all. If an SPF record already exists, edit it instead of adding another. - No. SPF breaks on forwarding and doesn't say what to do with spoofed mail. Gmail and Yahoo require SPF, DKIM and DMARC from anyone sending more than 5,000 emails a day, and for smaller senders the three together still noticeably improve delivery.
Rather not deal with email DNS records?
Atak Domain Business Email adds the MX, SPF and DKIM records for you, with support every day; from $0.99 a month.