SPF (Sender Policy Framework) tells receiving mail servers which IP addresses and domains are authorized to send email on behalf of your domain. A misconfigured SPF record can cause legitimate emails to land in spam or be rejected entirely. The SPF Record Validator instantly fetches any domain's SPF TXT record from DNS, parses every mechanism, counts DNS lookups (max 10 allowed by RFC 7208), and flags syntax errors and common misconfigurations. Powered by Cloudflare's free DNS over HTTPS API — no API key needed, runs entirely in your browser.
How to Use the SPF Record Validator
Validating an SPF record is fast and simple:
Enter a domain. Type any domain name into the input (e.g., google.com). The tool will query the domain's TXT records.
Click Validate. The tool sends a DNS over HTTPS request to Cloudflare and filters TXT records for one starting with v=spf1.
Review the analysis. Each SPF mechanism is listed with its qualifier, a plain-English explanation, and whether it counts toward the 10-lookup limit. The tool shows total DNS lookups used and warns if you're over the limit.
Key features:
- Live DNS lookup — queries real DNS data in real time
- Full mechanism parsing — include, ip4, ip6, a, mx, redirect, exists, all
- DNS lookup counter — tracks usage against the RFC 7208 limit of 10
- Qualifier analysis — explains +all vs ~all vs -all vs ?all
SPF Mechanisms Explained
An SPF record contains mechanisms that define which senders are authorized:
- include: — References another domain's SPF record. Example:
include:_spf.google.comauthorizes Google's mail servers. Counts as a DNS lookup. - ip4: / ip6: — Authorizes a specific IPv4 or IPv6 address or CIDR range. Does NOT count as a DNS lookup.
- a — Authorizes the domain's A/AAAA records. Counts as a DNS lookup.
- mx — Authorizes the domain's MX record IPs. Counts as a DNS lookup.
- redirect= — Replaces the entire SPF check with another domain's record. Counts as a DNS lookup.
- exists: — Advanced mechanism that checks if an A record exists. Counts as a DNS lookup.
- all — Catch-all mechanism. Qualifiers:
-all(hard fail),~all(soft fail),+all(allow all — dangerous),?all(neutral).
Common SPF Issues & Fixes
Watch out for these frequent SPF problems:
- Too many DNS lookups — SPF is limited to 10 DNS lookups per evaluation. Each
include,a,mx,redirect, andexistscounts as one. Exceeding 10 causes a PermError and email delivery failures. Fix: consolidate includes or replace them withip4/ip6ranges. - Using +all — The
+allqualifier authorizes every IP on the internet to send as your domain. This completely negates SPF. Always use-allor~all. - Missing all mechanism — Without an
allat the end, there's no default action for unauthorized senders. Always end with-all(recommended) or~all. - Multiple SPF records — A domain must have exactly one SPF TXT record. Multiple records cause a PermError. Merge them into a single record.
- Record too long — DNS TXT records have a 255-character limit per string. Longer records must be split into multiple strings within a single TXT record. Most DNS providers handle this automatically.
Step-by-Step Instructions
- 1Enter a domain name (e.g., google.com) in the input field.
- 2Click 'Validate SPF' to fetch the DNS TXT records.
- 3View the raw SPF record retrieved from DNS.
- 4Review each parsed mechanism with its qualifier and explanation.
- 5Check the DNS lookup counter against the 10-lookup limit.
- 6Address any warnings or errors flagged by the validator.