What we check
We check your SPF record is valid and properly configured
We check that your SPF (Sender Policy Framework) record is present, valid, and not exceeding the DNS lookup limit. SPF tells receiving mail servers which IP addresses are authorized to send email from your domain, preventing spammers from forging your address.
Security Impact
Why SPF configuration is critical
Without SPF, spammers can forge your domain
Anyone can send emails claiming to be from your domain. SPF prevents this by declaring which servers are legitimate, protecting your brand from spoofing.
Your legitimate emails land in spam
Missing or invalid SPF causes your legitimate emails to be marked as spam or rejected entirely by receiving servers. This destroys email deliverability.
Failed authentication hurts sender reputation
Every SPF failure damages your domain reputation with email providers. Over time, this leads to permanent deliverability issues even after fixing SPF.
Phishing attacks damage your brand
When spammers forge your domain for phishing, customers lose trust in all emails from your domain—even legitimate ones.
Implementation
How to configure SPF records
With Httpeace
Httpeace automatically validates your SPF configuration:
- Add your domain to Httpeace
- We check SPF records automatically every day
- Get instant alerts if SPF is missing, invalid, or exceeds lookup limits
- See recommended SPF configuration for your email providers
Without Httpeace
Manual SPF implementation and monitoring requires understanding complex syntax:
# Check SPF record via command line dig TXT yourdomain.com | grep spf # Test SPF validation # Visit: https://mxtoolbox.com/spf.aspx # Count DNS lookups (must be ≤10) # Visit: https://www.kitterman.com/spf/validate.html # Send test email and check headers # Look for "spf=pass" in authentication results
You'll need to:
- Learn SPF syntax: v=spf1, include:, ip4:, ip6:, a:, mx:, all qualifiers
- Determine which email services send from your domain
- Get SPF include strings from each email provider
- Combine multiple providers into single SPF record (only ONE allowed)
- Understand ~all (soft fail) vs -all (hard fail) implications
- Count DNS lookups for include:, a:, mx: (must stay under 10)
- Test SPF record with online validators before publishing
- Wait 24-48 hours for DNS propagation
- Send test emails and verify SPF passes in headers
- Monitor for authentication failures in email reports
- Update SPF when adding/removing email services
- Handle SPF for subdomains separately
- Watch for DNS lookup limit violations as you add services
- Document SPF configuration for team reference
- Set up ongoing monitoring to catch SPF breakage
SPF is deceptively complex. Syntax errors, multiple records, or exceeding lookup limits cause complete authentication failure, sending all your emails to spam.
FAQ
Frequently asked questions
What is SPF?
SPF (Sender Policy Framework) is an email authentication method that specifies which mail servers are authorized to send email on behalf of your domain. Receiving servers check SPF records to verify emails are from legitimate sources.
What does ~all vs -all mean?
~all (soft fail) means "if the email doesn't match SPF, mark it suspicious but still deliver." -all (hard fail) means "reject emails that don't match SPF." Start with ~all to avoid blocking legitimate emails during testing.
Can I have multiple SPF records?
No! You can only have ONE SPF record per domain. Multiple SPF records cause all of them to fail. Instead, use multiple include: statements within a single SPF record to authorize multiple email providers.
What is the DNS lookup limit?
SPF records are limited to 10 DNS lookups to prevent performance issues. Each include:, a:, mx:, and redirect: counts as a lookup. Exceeding 10 lookups causes SPF validation to fail completely. See our SPF Record Limits check for more details.
How often does Httpeace check SPF?
We check your SPF record daily. We verify it exists, is properly formatted, doesn't exceed DNS lookup limits, and follows best practices. We alert you immediately if SPF is missing, invalid, or breaks.
Related checks
Other checks in this category
Peace of mind for your domains.
Start monitoring today and prevent outages, hacks, and costly mistakes.