SPF Record Lookup

What is EasyDMARC's SPF Record Checker and Lookup Tool?

Our SPF Record Checker and Lookup tool allows you to check if an SPF record is published on a domain and deployed correctly. It also features a DNS lookup counter.

What is SPF Lookup Used for?

While this tool checks for SPF records, it also counts DNS lookups, including main and nested lookups to ensure correct configuration.

How Does the SPF Record Checker Help?

It helps when there is a need to add a specific domain to a record to send emails on behalf of your organization. Our SPF Record Checker tool is useful if you want to check:

• IP addresses of the sources are correct.
• That no syntax errors exist.
• That no ‘10 DNS lookup’ errors exist.

Why Should You Set an SPF Record?

The SPF record protects a company’s domain from being spoofed while improving its sender reputation with MBPs (Mailbox Providers) such as Google, Microsoft, Verizon, etc. Most companies and individuals use SPF records to prevent spoofing and enhance email security and deliverability.

How to Check SPF Records?

Easy! Simply use our free SPF Record Checker tool on our EasyDMARC platform. Enter the domain name in the box and click 'Check SPF.' You'll receive all lookup and check results for that domain momentarily.

How Does SPF Authentication Work?

When an email is sent, the receiving server checks the sender’s return-path address, and verifies if the domain in use has a valid SPF record by performing a DNS query. If it passes, it is authenticated and delivered to the recipient's mailbox.

What are Some SPF Best Practices?

• 1. Only include sources in your SPF record if you're sure that the Return-Path domain is yours: Some third-party ESPs, such as Mailchimp, handle your bounces, so they have their own domain in the Return-Path address. For sources like Mailchimp, you don't need to add their "include" in your SPF record.
• 2. Use either "~all" or "-all" mechanisms and avoid using "+all" or "?all": Both "~all" and "-all" work in the same way by marking SPF failures. It's important to avoid using "+all" because it whitelists all email sources, and "?all" is neutral, which means it neither passes nor fails SPF checks.
• 3. Avoid using the redirect= mechanism in your SPF record: Using redirect= can limit users by not letting them add other sources. As organizations tend to use multiple email strategies, it can limit that process. Instead, include all authorized email sources in your SPF by "include:" and other mechanisms.
• 4. If your domain is hosted on third-party email service providers (ESPs) such as Google, Microsoft, Zoho Mail, etc., avoid using MX & A in your SPF record and use a list of IP addresses instead. The reason is that Google and Microsoft's MX IP addresses differ from their outgoing mail servers. Instead, you can use the "include" mechanism that third-party ESPs give you.
• 5. Use DKIM and DMARC to complement your SPF record: SPF is only one of the three main email authentication methods. We recommend implementing DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting & Conformance (DMARC) to improve your email deliverability and protect your domain from email spoofing and phishing attacks.

What Are Some SPF Record Examples?

1. Allow only one server to send email:

v=spf1 ip4:198.51.100.1 -all

This SPF record allows only the mail server with IP address 198.51.100.1 to send emails. All other servers will be considered unauthorized.

2. Allow a list of IP addresses within a given range to send email:

v=spf1 ip4:192.0.2.0/24 -all

This SPF record allows any server with an IP address within the range of 192.0.2.0/24 to send emails. All other servers will be considered unauthorized.

3. An SPF record that includes a third-party email service:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all

This SPF record allows any servers listed in Google's SPF record (_spf.google.com) and Microsoft's SPF record (spf.protection.outlook.com) to send emails on behalf of the domain. All other servers will be considered unauthorized.

4. SPF record that combines IPv4, IPv6, and third-party services:

v=spf1 ip4:192.0.2.0/24 ip6:2001:0db8:85a3::/64 include:_spf.google.com include:spf.protection.outlook.com -all

This SPF record allows any server with an IPv4 address within the range 192.0.2.0/24, any server with an IPv6 address within the range 2001:0db8:85a3::/64, as well as any server listed in Google's SPF record (_spf.google.com) and Microsoft's SPF record (spf.protection.outlook.com), to send emails on behalf of the domain. All other servers will be considered unauthorized.

How Does the Sender Policy Framework Protect Email?

The Sender Policy Framework (SPF) is an email authentication protocol that helps protect email by preventing email spoofing. Email spoofing is sending emails from a fake email address or domain to impersonate someone else. SPF allows domain owners to specify a list of IP addresses authorized to send emails on their behalf.

When the receiving mail server gets an email, it checks the SPF record of the sender's domain to see if the IP address used is authorized. If it's not, the receiving mail server can reject the email or mark it as spam.

SPF is one of the oldest authentication methods, but it is not foolproof. One limitation of SPF is that it only checks the "envelope" sender address, which is used for routing purposes. It doesn't look at the "From" address visible to the recipient. This means that SPF cannot prevent all types of email spoofing, for example, when an attacker uses a legitimate but compromised email account to send malicious emails.

Moreover, SPF is just one of several email authentication methods, including DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting, and Conformance (DMARC). Most mail servers don't solely rely on SPF policy to accept or reject emails. However, some local providers still "respect" the original SPF policy with -all, which means that if an email fails the SPF check, it'll be rejected.

How to Implement and Manage an SPF Record?

1. Publish DMARC record with EasyDMARC to start receiving aggregate reports: One of the first things you can do to get the most out of your SPF record is to publish a DMARC record. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that helps prevent email spoofing and phishing. With DMARC, you can specify how the receiving servers should handle your email messages if they fail SPF and DKIM checks. EasyDMARC platform helps you get started with DMARC in just a few clicks and provides DMARC reporting and monitoring capabilities, which offer valuable insights into your email authentication processes.

2. Gather and evaluate data on your sending sources: Use the reports to gather data and evaluate your sending sources to advance your email authentication efforts. This information will help you identify the list of IP addresses and domains you must include in your SPF record. EasyDMARC gives you tools to analyze your email traffic and identify your legitimate sending sources.

v=spf1 include:thirdpartydomain.com include:anotherthirdpartydomain.com ip4:[ip-address] ~all

This record authorizes two third-party domains to send emails on behalf of your domain and includes a specific IP address.

4. Publish your SPF TXT record in the DNS: After creating your SPF TXT record, publish it in your DNS. Your DNS zone is a database that contains information about your domain's DNS records. You can add your SPF TXT record to the DNS zone file using your domain registrar or DNS hosting provider's control panel.

5. Ensure that everything is published correctly using an SPF diagnostic tool: After posting your SPF record, verify that everything is working using an SPF checker tool. This step validates your SPF record's syntax and confirms it works correctly.

6. Evaluate further reports and ensure SPF is passing: You must evaluate the reports you'll receive periodically to ensure your SPF record is passing. Use EasyDMARC to monitor your email authentication process and receive reports on your SPF record status. If your SPF record is not passing, update it to include additional authorized sending sources.
Implementing an SPF record is essential to ensure your email messages are delivered successfully to your recipient inboxes. Following the steps outlined above and using a reliable tool like EasyDMARC, you can create and manage an adequate SPF record that helps prevent email spoofing and phishing attacks.

How To Check SPF Record via Command Line via Dig Tool?

If an SPF diagnostic tool isn't your cup of tea, use the command line to check your SPF record.

How Does SPF Impact Email Deliverability?

Sender Policy Framework (SPF) is an essential email authentication protocol for improving email deliverability. By authorizing specific IP addresses to send emails on behalf of a domain, SPF helps to verify the authenticity of incoming messages. When an email has a valid SPF record, it's more likely to be trusted by receiving mail servers, leading to improved deliverability rates.

Additionally, SPF is a critical component in achieving DMARC compliance, essential for maintaining a positive email reputation and enforcing email authentication protocols. By implementing SPF alongside DKIM, organizations can ensure their emails are correctly authenticated and protected from spoofing or phishing attacks, ultimately leading to higher deliverability rates and better overall email performance.

What Are the Common Mistakes During SPF Record Setup?

When setting up SPF records, it's essential to avoid common mistakes that can lead to email delivery issues or security vulnerabilities. Here are some of them:

How To Troubleshoot SPF Authentication Failures?

Do I Need an SPF Automation for SPF Record Management?

We strongly recommend automation, especially if you’re managing multiple domains in large organizations.
While it is possible to manually manage your SPF record, efficiency and speed are what you get with SPF record management services like Managed SPF by EasyDMARC. You can avoid making syntax errors during SPF configuration and management that would render your record useless. Keeping the record up-to-date is yet another benefit of using a managed solution. We recommend you assess your organization’s needs and circumstances to make the right choice.

What is a DNS Lookup Limitation?

10 DNS lookups is one of SPF's limitations. Each time an email server receives an email, it needs to look up the SPF record for the sender's domain to determine whether the email is legitimate or not. If the checks bypass the limit, SPF fails.

Each additional lookup adds to the email processing time and can increase the risk of email delivery delays or timeouts

What Is an SPF PermError?

SPF permerror (i.e. permanent error) is a common SPF issue that stems from the record containing a serious problem that hinders record interpretation. It results in SPF failure and the email in question doesn’t get delivered.

What Are Some Common Causes of an SPF PermError?

SPF PermError occurs when:

Investigating your SPF record with a diagnostic tool like our SPF Checker will help you to find and resolve them, ensuring DMARC compliance and better inbox placement.

How Does an SPF PermError Affect Email Deliverability?

Email deliverability improvement is an indirect effect of implementing email authentication protocols (SPF, DKIM, and DMARC). DMARC rests on SPF and DKIM protocol success. If one of them fails, the chance of DMARC success is drastically diminished. SPF permerror causes the SPF protocol to fail, so DMARC compliance and, consecutively, email deliverability is endangered.

What Is SPF Flattening, and Why Is It Necessary?

SPF flattening replaces SPF mechanisms that complicate the record with IP4 and IP6 rules, eliminating multiple DNS lookups and leaving the record in a better shape. Leaving the process with a trusted SPF service also reduces your involvement, automating it.

What Happens When You Exceed The SPF DNS Lookup Limit?

If the Sender Policy Framework (SPF) DNS lookup limit is exceeded, the SPF record validation will fail, and the receiving email server will likely reject the email message or mark it as spam. This can negatively impact email deliverability and may result in important emails being blocked or sent to the recipient's spam folder.

How to Fix An "SPF Too Many DNS Lookups" Error?

"SPF too many DNS lookups" error occurs when your SPF record includes multiple mechanisms that require DNS lookups, such as "include" and "a" or "mx" mechanisms, and the total number of lookups exceeds the limit of 10, set by the SPF specification.

You can do everything manually, but it would be much easier if you sign up to a service like EasyDMARC's Managed SPF and configure a flattened SPF for your domain.