SPF
What is SPF?
SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are authorized to send email claiming to be from a domain, checked against the IP that actually delivered a message. AdminKit's SPF Check tool checks a domain's SPF record and its DNS lookup count directly.
By AdminKit team, Netbase JSC · Updated
SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are authorized to send email claiming to be from a domain. A receiving mail server checks the SPF record of the domain in the message’s envelope sender address against the IP that actually delivered the message; a mismatch can be treated as a sign of spoofing. SPF records use mechanisms like include:, ip4:, and mx to name authorized senders, and end with a qualifier (-all hard-fails unauthorized senders, ~all soft-fails) that sets how strictly a mismatch is treated. Microsoft’s SPF setup guide for Microsoft 365 adds a common pitfall: more than one SPF TXT record for the same domain causes SPF to return permerror, because the receiving system can’t determine which record to evaluate, so a domain should publish only one. RFC 7208 (current document status at its IETF Datatracker entry) defines SPF and caps lookups at 10 to limit DNS load; to check a record’s syntax and lookup-causing term count against that limit from pasted text alone, with no DNS lookups performed, see AdminKit’s SPF validator. dmarc.org’s overview covers how SPF fits alongside DKIM and DMARC. A receiving server typically records this verdict, alongside its DKIM and DMARC results, in the Authentication-Results header it adds to the message.
Frequently asked questions
Does SPF alone stop email spoofing?
Not completely -- SPF only checks the envelope sender's domain against the delivering IP, which doesn't protect the visible "From" address a recipient sees; DKIM and DMARC address that gap, which is why SPF is normally deployed alongside them.
What happens when SPF validation fails?
It depends on the record's qualifier -- a -all hard-fail is meant to tell the receiving server to reject unauthorized senders outright, while ~all soft-fails them, typically meaning the mail is accepted but flagged or scored as suspicious.
Why does SPF cap DNS lookups at 10?
RFC 7208 sets the limit to prevent a single SPF check from triggering an unbounded number of DNS lookups, which could be used to overload resolvers or stall mail delivery; exceeding it causes SPF validation to fail.
How can I check a domain's SPF record and lookup count?
AdminKit's SPF Check tool checks a domain's SPF record and its DNS lookup count directly.