SPF Record Checker

What is SPF?

SPF is a DNS record that tells other servers which places are allowed to send mail that looks like it came from your domain. When mail shows up claiming to be from you, the receiver can check that list and see if the actual sending IP matches something you said was okay.

Most of the time the list just points to your email service—like Google, Microsoft, or Mails.now (mailapi.tech)—plus maybe a couple of extra IPs for other tools. It does not stop anyone from changing the message itself, and it does not make the mail private. It only says whether the server was supposed to send on your behalf.

Why SPF is important

It is one of those things that seems small until it starts causing problems with where your mail lands. Without it, other companies can pretend to be you more easily, and your real messages might get filtered more often. A lot of services also expect it now if you want good delivery rates.

The main reason it matters is that spoofing is still easy to do. Anyone can put your address in the From line. SPF gives receivers a way to say no to the ones that should not be sending. It also helps later when you try to set up DMARC, because that system checks whether SPF or the other record passed.

If you add new tools that send mail, you have to remember to update the record or things can break without warning. Sales platforms and billing apps often need their own include added. Checking before you launch something new keeps you from wondering why mail suddenly stops reaching inboxes.

What an SPF record looks like

An SPF record is a single TXT record published at your domain root. It always starts with v=spf1, then lists allowed senders, and usually ends with an all rule.

Here is a typical Mails.now record broken into parts:

v=spf1 include:spf.mailapi.tech ~all

Real SPF record examples

These are real patterns you will see in DNS. Copy the include your provider documents, then keep everything in one SPF TXT record.

How to check SPF on this site

Use the checker at the top of this page to look up your domain’s SPF record and review mechanisms, lookup count, and recommended fixes.

1. Scroll to the SPF Record Checker form at the top of this page.
2. Enter your domain in the Domain Name field (for example, mailapi.tech or your own domain that sends through Mails.now).
3. Click Check SPF Record.
4. Wait for the report. Review the status badge, the raw SPF TXT value, and the grouped mechanisms (includes, IPs, MX, and so on).
5. Check the DNS Lookups count and stay at or under 10 nested lookups.
6. Read any recommendations, fix DNS if needed, wait for propagation, then run the check again.

How SPF works

When mail comes in, the server grabs the IP that connected and looks up your record. It goes through the list in order until something matches or it hits the final all rule. That final part decides what happens to senders not on the list. Soft fail is common because it flags things without being too strict while you are still figuring out the list.

The limit of ten lookups is easy to hit if you have several vendors. Each include can pull in more records, so you end up counting nested ones too. Reports usually tell you the count so you can fix it before mail starts failing.

What happens if SPF fails

If the IP is not allowed, the mail either fails or gets a soft fail. On its own, that mostly affects spam scores. When you have DMARC running, it can lead to the mail being quarantined if the other check also does not pass.

Common SPF mistakes

1. Publishing two SPF TXT records instead of one merged record.
2. Forgetting to add a new sending service’s include.
3. Typos in IP ranges or include hostnames.
4. Leaving the record wide open with +all.
5. Keeping outdated includes after switching providers.
6. Stacking too many includes and going over the 10-lookup limit.
7. Publishing the record on the wrong hostname when you send from a subdomain.

How to add SPF

1. Open your DNS provider for the domain that appears in your From address.
2. Create one TXT record at the root (host @ or blank, depending on the panel).
3. Set the value to start with v=spf1, add your provider includes (for Mails.now use include:spf.mailapi.tech), and end with ~all or -all.
4. Do not create a second SPF record—merge everything into that one line.
5. Save the record, wait for DNS to propagate, then check it with the tool on this page.

Where DNS is managed and how long changes take

DNS changes can take anywhere from a few minutes to a couple of days depending on the host. It is worth keeping a note of what you changed and when so you can check later.

Difference between SPF, DKIM, and DMARC

It works differently from DKIM, which signs the actual message, and from DMARC, which tells receivers what to do on failure. SPF is more like the allowlist part. After you get it working, you usually check the other two as well.

SPF best practices

1. Keep exactly one SPF TXT record per domain (or subdomain) that sends mail.
2. Stay under the DNS lookup limit of 10.
3. Review the record whenever you add or remove a sending service.
4. Prefer ~all while you inventory senders, then move to -all when the list is complete.
5. Keep a simple inventory of every tool that sends mail so nothing is missed after a trial ends.

Frequently asked questions