SPF check
Inspect SPF records and references for duplicates and possible ten-term limit issues. This does not evaluate SPF authentication for an individual message.
Instructions, guides and related tools
Result
Diagnostic results will appear here
Related checks and services
Planning email for your own domain? Explore Google Workspace features and service terms.
What this check does
Finds v=spf1 in TXT records and shows it. Warns on duplicates and excessive lookups.
How to read the result
Publish one SPF record per domain. The reference count is a static configuration check. A real message's evaluation can stop earlier depending on its sending IP; this count is not that message's authentication result.
Glossary
- include
- Pulls in another domain's SPF; too many can hit the limit.
FAQ
- What if there's no SPF?
- The domain's SPF authorization cannot be checked. Other authentication such as DKIM operates independently. Check the required SPF configuration with your sending provider.
Updated:
What to check next
This statically inspects v=spf1 TXT records and their references. It is not an SPF authentication simulator with a sending IP, MAIL FROM and HELO, and cannot certify a message's SPF pass.
1. Identify the SPF domain and senders
SPF normally uses the MAIL FROM domain, which can differ from the visible From. Inventory mail, website forms, notifications and mailing services you actually use.
2. Separate duplicates, loops and DNS failures
Consolidate multiple v=spf1 records into one. Correct include/redirect loops. A timeout or SERVFAIL is not evidence of absence; retry before deciding to change DNS.
3. Understand the ten-term limit
DNS-triggering mechanisms and redirect have an evaluation limit, including nested references. It is not a TXT character limit or an HTTP request count. This static check does not reproduce the evaluation path for each sending IP.
4. Verify with providers and actual messages
Remove unused sending services and follow each provider's supported records. Changing ~all to -all does not fix excessive lookups. After correction, send through each active stream and inspect the receiving service's authentication result.
Specifications and review date
Guidance reviewed:
