About SPF Records
What is an SPF record?
An SPF record is a DNS entry listing which servers are permitted to send email for your domain. A receiving server checks the sending address against that list to decide whether a message is plausibly genuine.
It is one line of text, and it is the foundation the rest of email authentication builds on. DKIM signs messages cryptographically and DMARC decides what to do when checks fail, but both assume SPF is in place and correct.
An SPF record tool matters because the record is easy to write and easy to get subtly wrong, and nothing about sending email tells you it is wrong. Messages simply arrive less often.
Does SPF still matter in 2026?
It is effectively mandatory. Mail from domains without SPF is treated with suspicion, and the major providers now require authentication for anything sent at volume, with enforcement tightening rather than loosening.
It is also easy to break as an organisation grows. Every marketing platform, helpdesk, invoicing tool and CRM that sends on your behalf needs including, and each one is added by a different team at a different time.
The ten DNS lookup limit is the trap nobody expects. Each included service consumes lookups, and once the record exceeds ten it fails to evaluate entirely, taking your authentication with it.
SPF best practices
- Publish exactly one SPF record; multiple records invalidate each other.
- Include every service that sends on your behalf, and remove ones you have stopped using.
- Stay within the ten DNS lookup limit, or the record fails to evaluate.
- End with a strict qualifier once you are confident the list is complete.
- Publish a record even for domains that never send mail, so they cannot be spoofed.
- Revisit it whenever you add or remove a sending platform.
What this tool checks
The SPF record tool queries DNS and reports whether a record exists, is missing, or is duplicated.
It confirms presence and uniqueness rather than validating that the servers listed are the right ones or that the lookup limit is respected. Those are worth checking separately once the record exists.
Where to go next
SPF is the first of three email authentication records. Add
DMARC to decide what happens when checks fail, review your
DNS configuration where all of these live, and check whether your site publishes
email addresses in a form that invites the spam SPF is defending against.