SPF
SPF is a TXT record naming the servers allowed to send for your domain. This hub covers the conditions an evaluator can report, what each one means in RFC 7208, and how to fix it without cutting off a sender you still use. Start with the intent that matches you, or check your record first and come back with the result.
Check your SPF record Reads the live record and counts every DNS lookup it costs.
Where do you want to start?
- Understand — What SPF is and what an evaluator actually returns.
- Diagnose — You have a result and want to know what caused it.
- Check a record — Read your live record and see every lookup it costs.
- Fix safely — Change the record without silently dropping a sender.
- Monitor — Know when it breaks later, rather than when replies stop.
Conditions an SPF check can report
Eighteen conditions, of which five have pages today. The rest are listed because the list is the diagnostic surface, and a list that only shows what we have written is a list you cannot use to find out that something exists.
- No SPF record found
- More than 10 DNS lookups
- More than one SPF record
- An include target publishes no SPF record
- ~all versus -all
- Syntax error in the record — page not published yet
- Too many void lookups — page not published yet
- Uses the deprecated ptr mechanism — page not published yet
- redirect= combined with an all mechanism — page not published yet
- Macro expansion in the record — page not published yet
- Record split across multiple TXT strings — page not published yet
- Stray whitespace or hidden characters — page not published yet
- Version tag not lowercase v=spf1 — page not published yet
- exp= explanation modifier present — page not published yet
- Sending subdomain has no record of its own — page not published yet
- Lookup timed out (temperror) — page not published yet
- Domain publishes null MX but sends mail — page not published yet
- Two includes covering the same senders — page not published yet
RFC 7208, section by section
| Section | Title | Quoted |
|---|---|---|
| §3.2 | Multiple DNS Records | “A domain name MUST NOT have multiple records that would cause an authorization check” |
| §4.6.4 | DNS Lookup Limits | “If this limit is exceeded, the implementation MUST return "permerror"” |
| §5.2 | include | “The "include" mechanism triggers a recursive evaluation of check_host()” |
| §8.1 | None | “the SPF verifier has no information at all about the authorization” |
| §8.4 | Fail | “an explicit statement that the client is not authorized to use the domain” |
| §8.5 | Softfail | “Receiving software SHOULD NOT reject the message based solely on this result” |
| §2.6.7 | PermError | “the domain's published records could not be correctly interpreted” |
What we do not claim
We report what your DNS publishes and what an evaluator would return from it. We do not state what any mailbox provider will do with that result: those decisions are theirs, they are not published, and we cannot measure them from here.
Reviewed by Venkat Nookala, last reviewed 2026-09-08.