Email authentication

What is an SPF record?

SPF (Sender Policy Framework) is a TXT record that lists the servers allowed to send email for your domain. Receiving servers check it to spot forged mail.

Updated · Published by HostFaddy · 3 min read

Check your SPF, DKIM and DMARC records

Free, no sign-up — results in seconds.

What an SPF record looks like

example.co.za.  IN  TXT  "v=spf1 a mx include:_spf.google.com ip4:196.22.132.10 ~all"

Read it left to right: the version (v=spf1), then the mechanisms that describe allowed senders, then a final all that says what to do with everyone else.

The main mechanisms

MechanismAllows
aThe IP addresses in the domain's A/AAAA records.
mxThe IP addresses of the domain's MX servers.
ip4: / ip6:Specific addresses or ranges.
include:Everything allowed by another domain's SPF record — how email providers and marketing platforms are added.
allMatches everything else. Always last.

~all, -all, ?all and +all

  • -all (fail) — mail from unlisted servers should be rejected. The strictest option.
  • ~all (softfail) — accept but treat as suspicious. A common, safe choice, especially alongside DMARC.
  • ?all (neutral) — no opinion. Provides little protection.
  • +all — allows any server to send as you. Never use it.

The rules that break SPF

  • Only one SPF record. Two TXT records starting with v=spf1 cause a permanent error and SPF fails for every message. Combine them into one.
  • Maximum of 10 DNS lookups. include, a, mx, exists and redirect each count, including lookups inside included records. Exceeding 10 is a permanent error. Remove services you no longer use, or replace includes with ip4/ip6 ranges where providers document them.
  • SPF checks the envelope sender (the Return-Path), not the visible From address. That's why DMARC is needed to protect the From address people see.

Building your SPF record

  1. List everything that sends email as your domain: your mailbox provider, website/contact forms, invoicing or CRM tools, newsletter platform.
  2. Add each provider's documented include: or IP range.
  3. End with ~all (or -all once you're confident).
  4. Publish it as a single TXT record on the root domain, then test it.

Check your SPF record

The Email Deliverability Checker finds your SPF record and flags missing records, weak all settings and duplicate records.

Frequently asked questions

Should I use ~all or -all?

~all is a safe default and works well with DMARC. Move to -all once you're sure every legitimate sender is listed.

Why does my SPF record fail even though it exists?

Common causes: two SPF records, more than 10 DNS lookups, a sending service that isn't included, or a syntax error.

Does SPF stop my email going to spam on its own?

No. Inbox providers look at SPF, DKIM, DMARC and your sending reputation together.