SPF Record Checker

What is SPF?

SPF, or Sender Policy Framework, is the first designed email authentication protocol. It defines all the senders that are authenticated to send emails on behalf of your domain. It’s the first step in email authentication. Along with DKIM and DMARC, SPF works to fully protect your domain infrastructure.

How Does SPF Authentication Work?

When an email is sent, the receiving server checks the sender’s return-path address and verifies if the domain in use has a valid SPF record. SPF authentication works by setting a special DNS record for a domain. This record lists all mail servers authorized to send emails on behalf of that domain. If SPF passes, the email under question is authenticated and delivered to the recipient's mailbox.

Why Should You Set an SPF Record?

The SPF record protects a company's domain from spoofing while improving its sender reputation with MBPs (Mailbox Providers) such as Google, Microsoft, Verizon, etc. Most companies and individuals use SPF records to prevent spoofing and enhance email security and deliverability.

Another reason for setting up an SPF record is to help prevent your domain from being used by spammers to send out fraudulent emails that appear to come from your domain. Setting an SPF record allows you to specify which IP addresses are allowed to send emails on behalf of your domain, and any emails sent from an IP address not listed in the record will be flagged as suspicious.

What is EasyDMARC's SPF Verification, Record Checker and Lookup Tool?

EasyDMARC’s SPF Checker lets you verify if an SPF record exists on a domain’s DNS and if it’s deployed correctly.
It checks for correct syntax and other issues, such as missing nameservers, invalid or missing IP addresses, and incorrect TXT records.

What is SPF Lookup Used For?

SPF Lookup verifies the sender's identity when an email is sent out. It involves performing a DNS lookup of the domain the sender claims to be from and verifying that the sender's IP address is listed in the SPF record for that domain. If the IP address does not match, then the email is considered to be from a fraudulent sender.
SPF Lookup is a critical security measure to prevent spoofing and differentiate between legitimate and fraudulent sources.
Read more about the SPF standard here.

How Does the SPF Record Checker Help?

EasyDMARC’s SPF Record Checker helps to ensure that:

• The SPF record exists
• The IP addresses of the sources are correct
• No syntax errors exist
• The record doesn’t contain “10 DNS lookup” error

How to Check SPF Records?

It’s easy; simply use EasyDMARC’s free SPF Record Checker tool. Enter the domain name in the box and click “Check SPF.” You'll receive all lookup and check results for that domain momentarily.
Alternatively, you can check the SPF records manually by running the command “nslookup -type=txt” followed by the domain name in a command prompt.

How Does the Sender Policy Framework Protect Email?

The Sender Policy Framework (SPF) is an email authentication protocol that helps protect email by preventing email spoofing. Email spoofing is sending emails from a fake email address or domain to impersonate someone else. SPF allows domain owners to specify a list of IP addresses authorized to send emails on their behalf.

When the receiving mail server gets an email, it checks the SPF record of the sender's domain to see if the IP address used is authorized. If it's not, the receiving mail server can reject the email or mark it as spam.

SPF is one of the oldest authentication methods, but it is not foolproof. One limitation of SPF is that it only checks the "envelope" sender address, which is used for routing purposes. It doesn't look at the "From" address visible to the recipient. This means that SPF cannot prevent all types of email spoofing, for example, when an attacker uses a legitimate but compromised email account to send malicious emails.

Moreover, SPF is just one of several email authentication methods, including DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting, and Conformance (DMARC). Most mail servers don't solely rely on SPF policy to accept or reject emails. However, some local providers still "respect" the original SPF policy with -all, which means that if an email fails the SPF check, it'll be rejected.

What are Some SPF Best Practices?

1. Only include sources in your SPF record if you're sure that the Return-Path domain is yours: Some third-party ESPs, such as Mailchimp, handle your bounces, so they have their own domain in the Return-Path address. For sources like Mailchimp, you don't need to add their "include" in your SPF record.
2. Use either "~all" or "-all" mechanisms and avoid using "+all" or "?all": Both "~all" and "-all" work in the same way by marking SPF failures. It's important to avoid using "+all" because it whitelists all email sources, and "?all" is neutral, which means it neither passes nor fails SPF checks.
3. Avoid using the redirect= mechanism in your SPF record: Using redirect= can limit users by not letting them add other sources. As organizations tend to use multiple email strategies, it can limit that process. Instead, include all authorized email sources in your SPF by "include:" and other mechanisms.
4. If your domain is hosted on third-party email service providers (ESPs) such as Google, Microsoft, Zoho Mail, etc., avoid using MX & A in your SPF record and use a list of IP addresses instead. The reason is that Google and Microsoft's MX IP addresses differ from their outgoing mail servers. Instead, you can use the "include" mechanism that third-party ESPs give you.
5. Use DKIM and DMARC to complement your SPF record: SPF is only one of the three main email authentication methods. We recommend implementing DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting & Conformance (DMARC) to improve your email deliverability and protect your domain from email spoofing and phishing attacks.

What Are Some SPF Record Examples?

1. Allow only one server to send email:

   1 v=spf1 ip4:198.51.100.1 -all

   This SPF record allows only the mail server with IP address 198.51.100.1 to send emails. All other servers will be considered unauthorized.

2. Allow a list of IP addresses within a given range to send email:

   1 v=spf1 ip4:192.0.2.0/24 -all

   This SPF record allows any server with an IP address within the range of 192.0.2.0/24 to send emails. All other servers will be considered unauthorized.

3. An SPF record that includes a third-party email service:

   1 v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all

   This SPF record allows any servers listed in Google's SPF record (_spf.google.com) and Microsoft's SPF record (spf.protection.outlook.com) to send emails on behalf of the domain. All other servers will be considered unauthorized.

4. SPF record that combines IPv4, IPv6, and third-party services:

   1 v=spf1 ip4:192.0.2.0/24 ip6:2001:0db8:85a3::/64 include:_spf.google.com include:spf.protection.outlook.com -all

   This SPF record allows any server with an IPv4 address within the range 192.0.2.0/24, any server with an IPv6 address within the range 2001:0db8:85a3::/64, as well as any server listed in Google's SPF record (_spf.google.com) and Microsoft's SPF record (spf.protection.outlook.com), to send emails on behalf of the domain. All other servers will be considered unauthorized.

How To Check SPF Record via Command Line via Dig Tool?

If an SPF diagnostic tool isn't your cup of tea, use the command line to check your SPF record.

1. Open your terminal or command prompt on your computer.
2. Type in dig txt domain.com or nslookup -q=txt domain.com. Replace domain.com with the domain name you want to check.
3. Click "Enter" to execute the command.
4. You will see a list of TXT records associated with the domain.
5. Look for the TXT record that starts with v=spf1. This is the SPF record for the domain.

dig txt easydmarc.us

How Does SPF Impact Email Deliverability?

Sender Policy Framework (SPF) is an essential email authentication protocol for improving email deliverability. By authorizing specific IP addresses to send emails on behalf of a domain, SPF helps to verify the authenticity of incoming messages. When an email has a valid SPF record, it's more likely to be trusted by receiving mail servers, leading to improved deliverability rates.

Additionally, SPF is a critical component in achieving DMARC compliance, essential for maintaining a positive email reputation and enforcing email authentication protocols. By implementing SPF alongside DKIM, organizations can ensure their emails are correctly authenticated and protected from spoofing or phishing attacks, ultimately leading to higher deliverability rates and better overall email performance.

What Are the Common Mistakes During SPF Record Setup?

When setting up SPF records, it's essential to avoid common mistakes that can lead to email delivery issues or security vulnerabilities. Here are some of them:

1. Avoid using the deprecated PTR tag in your SPF record.
2. Don't add multiple SPF TXT records on a single root domain or subdomain level, as this can cause conflicts and lead to unpredictable email delivery results (permerrors).
3. Be cautious about adding a source if the Return-Path domain doesn't match your organizational domain. This can increase the risk of unnecessary DNS lookups and exceed the 10 DNS lookup limit.
4. Avoid exceeding the 10 DNS lookup limitation. This can cause SPF permerror, negatively affecting your email delivery and inbox placement.
5. Avoid using the 'all' mechanism with the '+' qualifier (+all). This can whitelist any server to send emails from your domain, causing the SPF to pass in all cases. This configuration will compromise your email security.
6. Make sure to keep your SPF record up to date, especially if you change your email infrastructure or use a new email service provider.
7. Use a diagnostic tool like our SPF testing tool to test your SPF record before deploying it. This approach will ensure the SPF is valid and correctly configured.
8. Avoid creating overly complex SPF records. Long and complicated syntaxes increase the likelihood of errors and make it harder to manage.

How To Troubleshoot SPF Authentication Failures?

1. SPF record Verification: The first step is to verify that the SPF record configuration is correct. Check the SPF record using EasyDMARC's SPF Checker or command-line tool to ensure all the authorized IP addresses and sources are listed.
2. Check IP addresses: If the SPF authentication fails for a specific IP address, verify that the IP address is authorized to send emails on behalf of the domain. You can do this by checking the SPF record to ensure that the IP address is listed or by whitelisting the IP address if it needs to be added.
3. Check email headers: Check the email headers to see if there are any clues about why the SPF authentication is failing. Look for the "Received-SPF" header to see the result of the SPF check.
4. Verify alignment: If the SPF alignment is failing, the problem could be with the ESP portal. Check the ESP portal to ensure you're using the correct domain for the sender's email address.

Do I Need an SPF Automation for SPF Record Management?

We strongly recommend automation, especially if you’re managing multiple domains in large organizations.

While it is possible to manually manage your SPF record, efficiency and speed are what you get with SPF record management services like Managed SPF by EasyDMARC. You can avoid making syntax errors during SPF configuration and management that would render your record useless. Keeping the record up-to-date is yet another benefit of using a managed solution. We recommend you assess your organization’s needs and circumstances to make the right choice.

What is a DNS Lookup Limitation?

10 DNS lookups is one of SPF’s limitations. Each time an email server receives an email, it needs to look up the SPF record for the sender's domain to determine whether the email is legitimate or not. If the checks bypass the limit, SPF fails.

Each additional lookup adds to the email processing time and can increase the risk of email delivery delays or timeouts.

What Is an SPF PermError?

SPF permerror (i.e. permanent error) is a common SPF issue that stems from the record containing a serious problem that hinders record interpretation. It results in SPF failure and the email in question doesn’t get delivered.

What Are Some Common Causes of an SPF PermError?

SPF PermError occurs when:

• One domain has multiple SPF records
• The SPF record contains syntax errors
• DNS lookups exceed the allowed limit of 10

Investigating your SPF record with an SPF Validator tool like our SPF Checker will help you to find and resolve them, ensuring DMARC compliance and better inbox placement.

How Does an SPF PermError Affect Email Deliverability?

Email deliverability improvement is an indirect effect of implementing email authentication protocols (SPF, DKIM, and DMARC). DMARC rests on SPF and DKIM protocol success. If one of them fails, the chance of DMARC success is drastically diminished. SPF permerror causes the SPF protocol to fail, so DMARC compliance and, consecutively, email deliverability is endangered.

What Is SPF Flattening, and Why Is It Necessary?

SPF flattening replaces SPF mechanisms that complicate the record with IP4 and IP6 rules, eliminating multiple DNS lookups and leaving the record in a better shape. Leaving the process with a trusted SPF service also reduces your involvement, automating it.

What Happens When You Exceed The SPF DNS Lookup Limit?

If the Sender Policy Framework (SPF) DNS lookup limit is exceeded, the SPF record validation will fail, and the receiving email server will likely reject the email message or mark it as spam. This can negatively impact email deliverability and may result in important emails being blocked or sent to the recipient's spam folder.

How to Fix An “SPF Too Many DNS Lookups” Error?

"SPF too many DNS lookups" error occurs when your SPF record includes multiple mechanisms that require DNS lookups, such as "include" and "a" or "mx" mechanisms, and the total number of lookups exceeds the limit of 10, set by the SPF specification.

1. Remove unnecessary include: mechanisms
2. Use the IP4 and IP6 method
3. Remove mechanisms with duplicate functionality
4. Eliminate “ptr” mechanism

You can do everything manually, but it would be much easier if you sign up to a service like EasyDMARC’s Managed SPF and configure a flattened SPF for your domain.