SPF Checker
Use EasyDMARC's SPF Record Checker to find out which emails are considered safe by your organization.
Perform a DMARC, DKIM, or SPF record check to detect compliance and security issues
Analyze Your Domain In One Click
Check if your domain is compliant with the new
email authentication requirements
Risk Assessment Level: Low
Domains with a low security risk level have minimal or no significant authentication issues, ensuring robust protection against email-based threats, but periodic monitoring is advisable to stay ahead of emerging risks.
Risk Assessment Level: Medium
A medium security risk level signals notable SPF, DKIM, and DMARC issues, posing a potential risk of email spoofing; prompt resolution is recommended to strengthen overall security.
Risk Assessment Level: High
A domain with a high security risk level indicates critical vulnerabilities in SPF, DKIM, and DMARC, posing a severe threat of email impersonation and phishing attacks, necessitating urgent protocol enhancements.
DMARC
Domain-based Message Authentication,
Reporting and Conformance
SPF
Sender Policy
Framework
DKIM
DomainKeys
Identified Mail
Ensure your Emails are Protected with an SPF Check
Authenticate outbound emails with an SPF Record Check using EasyDMARC. SPF tests show that emails from your domain are legitimate and not spoofed.
First, check your SPF record to make sure it exists. Next, an SPF check will make sure your SPF record is valid. Simple issues like incorrect syntax and unoptimized inclusions can cause your SPF record to fail.
EasyDMARC’s SPF Record Checker and Lookup tool shows you the SPF lookup trees and sending sources so you can make sure your email is authenticated.
Watch EasyDMARC’s video explanation to discover how to use our SPF test tool.
What is SPF?
SPF, or Sender Policy Framework, is an email authentication protocol designed to protect your domain from being used for email spoofing. It works by specifying which mail servers are authorized to send emails on behalf of your domain.
When someone sends an email claiming to be from your domain, the recipient's mail server checks the SPF record in your domain’s DNS settings. If the sender's IP address matches the ones listed, the email passes the SPF check. Otherwise, it’s flagged as potentially fraudulent.
By implementing SPF, you strengthen your domain’s defenses against phishing attacks and improve email deliverability by building trust with mail servers and recipients.
The Best Tips for Implementing, Managing, and Verifying an SPF Record
Publish a DMARC Record: One of the first things you can do to get the most out of your SPF record lookup is to publish a DMARC record. DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that helps stop email spoofing and phishing. With DMARC, you can specify how the receiving servers should handle your email messages if they fail SPF and DKIM checks.
Gather and evaluate sending sources: Use EasyDMARC SPF checks to gather data about your sending sources. This can help you identify a list of IP addresses and domains you must include in your SPF record. EasyDMARC gives you the tools needed to analyze your email traffic and identify legitimate senders.
Create a TXT Record including all your sources: Your SPF record should specify the list of IP addresses and domains authorized to send emails on behalf of your domain. Your SPF record might look like this: v=spf1 include:thirdpartydomain.com include:anotherthirdpartydomain.com ip4:[ip-address] ~all
This particular record authorizes two third-party domains to send emails on behalf of your domain and includes a specific IP address.
Publish your SPF record in the DNS: After creating your SPF record, publish it in your DNS. Your DNS is a database that contains information about your domain's DNS records. You can add your SPF record to your DNS using your domain registrar or DNS hosting provider's control panel.
Use an SPF diagnostic tool: After posting your SPF record, an SPF diagnostic tool can verify that everything is working normally. This step validates your SPF record's syntax and confirms it works correctly.
Evaluate further reports to ensure your SPF is passing: You must evaluate the periodic reports you receive to ensure your SPF record is passing. EasyDMARC makes this easy by monitoring your email authentication process and sending reports on your SPF record status. If your SPF record is not passing, you should update it to include any additional authorized sending sources.
Implementing an SPF record is essential to ensure your email messages are delivered successfully. By employing these best practices and using a reliable tool like EasyDMARC, you can create and manage an SPF record that helps prevent email spoofing and phishing attacks.
SPF Best Practices
Only include sources in your SPF record if you're sure that the Return-Path domain is yours – Some third-party ESPs, such as Mailchimp, handle your bounces, so they have their own domain in the Return-Path address. For sources like Mailchimp, you don't need to add their "include" in your SPF record.
Use either "~all" or "-all" mechanisms and avoid using "+all" or "?all" – Both "~all" and "-all" work in the same way by marking SPF failures. It's important to avoid using "+all" because it whitelists all email sources. Avoid using "?all" as it is neutral, which means it neither passes nor fails SPF checks.
Don’t use the redirect= mechanism in your SPF record – Using redirect= limits your ability to add other sources, which can be restrictive for organizations using multiple email strategies. Instead, include all authorized email sources in your SPF using "include:" and other mechanisms
If your domain is hosted on third-party email service providers (ESPs), avoid using MX & A in your SPF record – ESPs like Google, Microsoft, Zoho Mail, etc. have MX IP addresses that differ from their outgoing mail servers. Rather, use the "include" mechanism that your ESP gives you.
Use DKIM and DMARC to complement your SPF record – SPF is only one of the three main email authentication methods. We recommend implementing DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting & Conformance (DMARC) to improve your email deliverability and protect your domain from email spoofing and phishing attacks.
What is SPF?
SPF, or Sender Policy Framework, was the first email authentication protocol to be established. It defines all the senders that are authenticated to send emails on behalf of your domain. It’s the first step in email authentication. Along with DKIM and DMARC, SPF works to fully protect your domain infrastructure.
Why Should You Set an SPF Record?
The SPF record protects a company's domain from spoofing while improving its sender reputation with MBPs (Mailbox Providers) such as Google, Microsoft, Verizon, etc. Most companies and individuals use SPF records to prevent spoofing and enhance email security and deliverability.
Another reason for setting up an SPF record is to help prevent your domain from being used by spammers to send out fraudulent emails that appear to come from your domain. Setting an SPF record allows you to specify which IP addresses are allowed to send emails on behalf of your domain, and any emails sent from an IP address not listed in the record will be flagged as suspicious.
What is EasyDMARC's SPF Verification, Record Checker and Lookup Tool?
EasyDMARC’s SPF Checker lets you verify whether an SPF record exists on a domain’s DNS and whether it’s deployed correctly.
It checks for correct syntax and other issues, such as missing nameservers, invalid or missing IP addresses, and incorrect TXT records.
What is SPF Lookup Used For?
SPF Lookup verifies the sender's identity when an email is sent out. It involves performing a DNS lookup of the domain the sender claims to be from and verifying that the sender's IP address is listed in the SPF record for that domain. If the IP address does not match, then the email is considered to be from a fraudulent sender.
SPF Lookup is a critical security measure to prevent spoofing and differentiate between legitimate and fraudulent sources.
Read more about the SPF standard here.
How Does the SPF Record Checker Help?
EasyDMARC’s SPF Record Checker helps to ensure that:
- The SPF record exists
- The IP addresses of the sources are correct
- No syntax errors exist
- The record doesn’t contain “10 DNS lookup” error
How to Check SPF Records?
It’s easy; simply use EasyDMARC’s free SPF Record Checker tool. Enter the domain name in the box and click “Check SPF.” You'll then receive all lookup and check results for that domain.
Alternatively, you can check the SPF records manually by running the command “nslookup -type=txt” followed by the domain name in a command prompt.
How Does SPF Authentication Work?
When an email is sent, the receiving server checks the sender’s return-path address and verifies whether the domain has a valid SPF record. SPF works by creating a special DNS record listing the mail servers authorized to send emails on behalf of that domain. If the sender’s IP address matches the authorized servers in the SPF record, the email is considered authenticated and delivered to the recipient's mailbox. If the IP address is not authorized, the receiving mail server can reject the email or mark it as spam.
What are the Limitations of SPF?
SPF is one of the oldest authentication methods, but it is not foolproof. One limitation of SPF is that it only checks the "envelope" sender address, which is used for routing purposes. It doesn't look at the "From" address visible to the recipient. This means that SPF cannot prevent all types of email spoofing.
Moreover, SPF is just one of several email authentication methods, including DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting, and Conformance (DMARC). Most mail servers don't solely rely on SPF policy to accept or reject emails. However, some local providers still "respect" the original SPF policy with -all, which means that if an email fails the SPF check, it'll be rejected.
What are Some SPF Record Examples?
- Allow only one server to send email:
- v=spf1 ip4:198.51.100.1 -all
- This SPF record allows only the mail server with IP address 198.51.100.1 to send emails. All other servers will be considered unauthorized.
- Allow a list of IP addresses within a given range to send email:
- v=spf1 ip4:192.0.2.0/24 -all
- This SPF record allows any server with an IP address within the range of 192.0.2.0/24 to send emails. All other servers will be considered unauthorized.
- An SPF record that includes a third-party email service:
- v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all
- This SPF record allows any servers listed in Google's SPF record (_spf.google.com) and Microsoft's SPF record (spf.protection.outlook.com) to send emails on behalf of the domain. All other servers will be considered unauthorized.
- SPF record that combines IPv4, IPv6, and third-party services:
- v=spf1 ip4:192.0.2.0/24 ip6:2001:0db8:85a3::/64 include:_spf.google.com include:spf.protection.outlook.com -all
- This SPF record allows any server with an IPv4 address within the range 192.0.2.0/24, any server with an IPv6 address within the range 2001:0db8:85a3::/64, as well as any server listed in Google's SPF record (_spf.google.com) and Microsoft's SPF record (spf.protection.outlook.com), to send emails on behalf of the domain. All other servers will be considered unauthorized.
How to Check Your SPF Record via Command Line via Dig Tool?
If an SPF diagnostic tool isn't your cup of tea, use the command line to check your SPF record.
- Open your terminal or command prompt on your computer.
- Type in dig txt domain.com or nslookup -q=txt domain.com. Replace domain.com with the domain name you want to check.
- Click "Enter" to execute the command.
- You will see a list of TXT records associated with the domain.
- Look for the TXT record that starts with v=spf1. This is the SPF record for the domain.
dig txt easydmarc.us
; <<>> DiG 9.10.6 <<>> txt easydmarc.us
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21471
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;easydmarc.us. IN TXT
;; ANSWER SECTION:
easydmarc.us. 300 IN TXT "v=spf1 include:_spf.easydmarc_us._d.easydmarc.pro ~all"
How Does SPF Impact Email Deliverability?
Sender Policy Framework (SPF) is an essential email authentication protocol for improving email deliverability. By authorizing specific IP addresses to send emails on behalf of a domain, SPF helps to verify the authenticity of incoming messages. When an email has a valid SPF record, it's more likely to be trusted by receiving mail servers, leading to improved deliverability rates.
Additionally, SPF is a critical component in achieving DMARC compliance, essential for maintaining a positive email reputation and enforcing email authentication protocols. By implementing SPF alongside DKIM, organizations can ensure their emails are correctly authenticated and protected from spoofing or phishing attacks, ultimately leading to higher deliverability rates and better overall email performance.
Do I Need an SPF Automation for SPF Record Management?
We strongly recommend automation, especially if you’re managing multiple domains in large organizations.
While it is possible to manually manage your SPF record, efficiency and speed are what you get with SPF record management services like Managed SPF by EasyDMARC. You can avoid making syntax errors during SPF configuration and management that would render your record useless. Keeping the record up-to-date is yet another benefit of using a managed solution. We recommend you assess your organization’s needs and circumstances to make the right choice.
What is a DNS Lookup Limitation?
10 DNS lookups is one of SPF’s limitations. Each time an email server receives an email, it needs to look up the SPF record for the sender's domain to determine whether the email is legitimate or not. If the checks bypass the limit, SPF fails.
Each additional lookup adds to the email processing time and can increase the risk of email delivery delays or timeouts.
What are Some Common Causes of an SPF PermError?
An SPF PermError occurs when the SPF record contains issues that prevent it from being correctly interpreted. This leads to SPF failure and undelivered emails. Common causes include having multiple SPF records for a domain, syntax errors in the record, or exceeding the allowed limit of 10 DNS lookups.
An SPF Validator tool, such as our SPF Checker, can help identify and resolve these issues, ensuring DMARC compliance and improved inbox placement.
How Does an SPF PermError Affect Email Deliverability?
Email deliverability improvement is an indirect effect of implementing email authentication protocols (SPF, DKIM, and DMARC). DMARC rests on SPF and DKIM protocol success. If one of them fails, the chance of DMARC success is drastically diminished. SPF PermError causes the SPF protocol to fail, so DMARC compliance, and subsequently, email deliverability, is endangered.
What Is SPF Flattening, and Why is it Necessary?
SPF flattening replaces SPF mechanisms that complicate the record with IP4 and IP6 rules, eliminating multiple DNS lookups and creating a more optimized record. Leaving the process with a trusted SPF service also reduces your involvement and automates it.