SPF Record Manager
Analyze your Sender Policy Framework configuration, inspect recursive lookups, and authorize senders with detailed structure insights.
Sender Policy Framework (SPF) is an email authentication method designed to detect forged sender addresses. It lets domain owners specify which mail servers are authorized to send email on behalf of their domain.
When an email is received, the recipient's mail server checks the SPF record. If the sender's IP isn't listed, the email might be forged, and the server can reject, quarantine, or flag it.
Implementing SPF strengthens defenses against phishing and improves email deliverability.
Key Benefits:
- Prevents Spoofing: Harder for attackers to impersonate your domain.
- Improves Deliverability: Legitimate emails are less likely marked as spam.
- Protects Brand Reputation: Avoids association with malicious emails.
Publish a DMARC Record.
DMARC leverages SPF and DKIM to provide broader email authentication, specify handling for failed messages, and offer reporting.
Keep your SPF record concise.
Avoid unnecessary mechanisms. A shorter record is easier to manage and less prone to exceeding the 10-lookup limit. Remove unused "include" mechanisms.
Regularly review and update.
Update your SPF record when adding or removing email sending services. An outdated record can cause legitimate emails to be flagged or rejected.
Test before deploying.
Use an SPF lookup tool (like this one) to test changes thoroughly, especially when moving to a stricter policy, to ensure all legitimate sources are covered.
An SPF record (a TXT record starting with 'v=spf1') uses mechanisms to define authorized senders and qualifiers to specify policy.
Common SPF Mechanisms:
- 'v=spf1': Version (must be first).
- 'a': Authorizes domain's A/AAAA records.
- 'mx': Authorizes domain's MX records.
- 'ip4': Authorizes specific IPv4 address/range.
- 'ip6': Authorizes specific IPv6 address/range.
- 'include': Includes another domain's SPF (e.g., 'include:_spf.google.com'). Counts towards lookup limit.
- 'all': Catch-all, usually last, defining default policy.
Qualifiers (prefix to mechanisms, default is '+'):
- '+' (Pass): Authorized.
- '-' (Fail/Hardfail): Not authorized, reject.
- '~' (Softfail): Not authorized, accept but mark/quarantine.
- '?' (Neutral): No explicit policy.
Consider the 10-lookup limit imposed by RFC 7208 to prevent DoS attacks. Nested includes, A, MX, and PTR mechanisms count towards this limit. IP4/IP6 mechanisms do not.
DNSBLs are lists of IP addresses suspected of sending spam. Mail servers check these lists to block emails from known spam sources.
Use '-all' or '~all' instead of '?all' or '+all'. Keep your record updated. Monitor DMARC reports.
Analysis Target
...
Live Scan Results