SPF
Enter a domain above to run this check.
SPF
CHECK.
Read the SPF policy, see whether it ends in -all or ~all and count the DNS lookups of the includes: over 10, SPF gives a PermError at the receiver.
Runs only this check. For all 33 checks at once, use the full Domain X-Ray. Public lookups only; nothing is stored on the server.
WAITING
What the check verifies
Reads the SPF policy, which lists who may send email on behalf of the domain, and estimates how many DNS lookups evaluating it takes.
Why it matters
Without SPF, or with +all, any server can pass itself off as the domain. More than 10 DNS lookups make the policy fail (PermError) at the receiver.
What each result means
- OK
- A single v=spf1 record, ending in ~all, -all or redirect=, within the limit of 10 DNS lookups.
- WARNING
- No SPF, ending in ?all, no all mechanism, or problems in the includes.
- FAIL
- More than one SPF record, +all (any server may send) or more than 10 DNS lookups, which causes a PermError at the receiver.
ERROR and TIMEOUT mean the query did not finish (the source was down or slow), not a problem with the domain: run the check again.
How to fix
A single TXT on the root name, with every service that sends email for the domain, ending in ~all (or -all when you are sure). A domain that sends no email publishes v=spf1 -all.
v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~allWould rather have someone else do it? Bit Happens can fix this →
More checks in Email
Full Domain X-Ray: all 33 DNS, email, HTTPS, certificate and reputation checks at once →