Validate the SPF record, policy and include chain.
SPF (Sender Policy Framework) lists which hosts may send mail for your domain, published as a DNS TXT record. Receivers use it to reject spoofed senders.
This tool fetches v=spf1, lists include and ip4/ip6 mechanisms, and explains -all / ~all. You can also build a record from IPv4, IPv6 and include fields.
Keep the string under 255 characters and DNS lookups (include, a, mx) at or below 10. Add the include for Google Workspace, Microsoft 365 or your own SMTP.
Several v=spf1 TXT records yield permerror; merge ip4, ip6 and include into one. Avoid ptr and macros.
Frequently asked questions
What is SPF?
A DNS TXT record that names which IPs may send mail for your domain. Missing SPF raises spoofing risk.
Which policy should I use?
Start with ~all while you inventory sources, then switch to -all. Never use +all.
Why does the include limit matter?
SPF allows at most 10 DNS lookups. Too many includes yield permerror and mail fails.
Will mail still send without SPF?
It can, but receivers treat it as easy to spoof. DMARC alignment also weakens.
What is the Google Workspace include?
include:_spf.google.com. Microsoft 365 often uses spf.protection.outlook.com.
Record too long?
Stay under 255 characters; split with include and keep the 10-lookup rule.
What does redirect= do?
It points the whole policy at another domain’s SPF. Easier one-record setups; still check alignment.