What is an SPF record?

SPF (Sender Policy Framework) is a TXT record that lists the servers allowed to send mail for a domain. It starts with v=spf1, names servers with mechanisms such as ip4, include and mx, and ends with an all mechanism that tells receivers what to do with mail from anywhere else.

What does the SPF checker test?

We look up the domain's TXT records, make sure there is exactly one SPF record, and follow every include and redirect to count the DNS lookups. We flag a count over 10, includes without an SPF record, include loops, unknown mechanisms, the deprecated ptr mechanism, mechanisms after all, and an all qualifier that leaves the domain open.

What is the SPF 10 DNS lookup limit?

RFC 7208 lets a receiver make at most 10 DNS lookups to evaluate one SPF record. The include, a, mx, ptr and exists mechanisms and the redirect modifier each cost one, and the lookups inside included records count too. Past 10, the receiver returns a permanent error and SPF fails for every message. Replace includes you no longer use, or swap an include for the ip4 and ip6 ranges it contains.

Should I use -all or ~all?

Both protect the domain. With -all (fail), receivers may reject mail from servers the record does not list. With ~all (soft fail), they accept it but treat it as suspicious. Most domains use ~all and let DMARC decide what happens to failing mail. Never use +all, which allows any server to send as you, and avoid ?all, which gives no protection.

Can a domain have two SPF records?

No. A domain must publish exactly one TXT record that starts with v=spf1. With two, receivers return a permanent error and SPF fails. Merge them into one record with all the mechanisms from both.

Yes. The /api/v1/email-auth endpoint returns the parsed SPF record, its include tree and lookup count, together with the DMARC and DKIM results. See the API documentation for authentication and plan limits.

Check the SPF record of any domain

Results for

github.com

Full analysis

Email authentication

2 warnings

Warning

SPF: Warning:~all (soft fail), 10 of 10 lookups
DMARC: Pass:p=quarantine
DKIM: Warning:7 keys: google, selector1, k1, k2, k3, s1, s2
MTA-STS: Note:Not set up
TLS reporting: Note:Not set up
BIMI: Note:Not set up
Mail servers: github-com.mail.protection.outlook.com

SPF record

10 of 10 DNS lookups

Warning

v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all

Uses 10 of 10 DNS lookups. One more include can break SPF.
Ends in ~all (soft fail), so receivers accept mail from unlisted servers but mark it as suspicious.

Includes

9 domains

include:spf.protection.outlook.com1 lookup
include:_netblocks.google.com1 lookup
include:_netblocks2.google.com1 lookup
include:mail.zendesk.com1 lookup
include:_spf.salesforce.com2 lookups
include:servers.mcsv.net1 lookup
include:mktomail.com1 lookup
include:sendgrid.net2 lookups
include:ab.sendgrid.net1 lookup

DMARC record

_dmarc.github.com

Pass

v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1

Policy p=quarantine: receivers send mail that fails DMARC to spam.
Aggregate reports go to dmarc@github.com.

Policy: quarantine (send to spam)
Subdomain policy: reject (refuse)
Percentage: 100%
Aggregate reports: dmarc@github.com
Failure reports: dmarc@github.com
DKIM alignment: Relaxed
SPF alignment: Relaxed

DKIM keys

24 selectors checked

Warning

google._domainkey.github.comPass:2048-bit RSA
Show record
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj6T5sl/RwdSqGoYWaWaFbS2UAeyPrEmd0gogocmRfS441qwR8/0KB81Hw89P0l4YiFRrXYk7NVIGfyCRHAYYZUzCkGeOysI2EjgzLFhd/NEsbRzOEc/kWkK/RO6JFq/5lOn6M9AZw/ap9tds4JG9ApgNNdSpPxp9DmvpsOSgNMVflRxQFrk3kdS4RNAPKu/OPoA7dlR/A/pECryjRoYgENtDXzdnK70HgCekems6UDzxDj61cjyoKoXtEMF/QsaHEQ1Gjfv014rDJBsubk/kT5VqHkWHa/ia68Z5r228Ety/wFfQNjXTx/J7KGZ9GkZlKED659eiJcLnWcKDSiQlhwIDAQAB
selector1._domainkey.github.comWarning:1024-bit RSA
- 1024-bit RSA key. 2048 bits is the current recommendation.
Show record
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxZC/z2cK+2s1f/ktzSDSeFzkfIHrjwtGFsfKMAYvKaXjPVNzKykpbXBkX5nB7dVUTFttda7aROr2iSrIseQ27Ui+4rUZVzgFanE8RaXhYM9n5wPKNv8GtLJk7JgcsYZ7ErgID4uW2sEYyV/dnRYw6rDzOaeRKkKELTUfJI5ebLQIDAQAB;
k1._domainkey.github.comWarning:1024-bit RSA
- 1024-bit RSA key. 2048 bits is the current recommendation.
Show record
k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbNrX2cY/GUKIFx2G/1I00ftdAj713WP9AQ1xir85i89sA2guU0ta4UX1Xzm06XIU6iBP41VwmPwBGRNofhBVR+e6WHUoNyIR4Bn84LVcfZE20rmDeXQblIupNWBqLXM1Q+VieI/eZu/7k9/vOkLSaQQdml4Cv8lb3PcnluMVIhQIDAQAB;
k2._domainkey.github.comPass:2048-bit RSA
Show record
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2aC2KjGKLOwTweBY5A9RpjsxaBXR9r7OAU6U8/zn92ivImI75naUujWbItRI/QmL1jy5PWGqLwoUA0b90ObWaLDc+i9MtTNmGeWO009hr20fIxhGg6XBT2kjZ1DTThopSe1nAndsupmcBwlQ5Q6LJ+ZAxLcujnPIxM0ZBLmgpkv8u6RfY4eFP8OLvdAW3oSuB0DyLDigQX4Sj8wBO4YIdQH6AAmBeOsidsKAFNFUCpc3vCxtBDR12U+cBg724l3sBkMQ8evnz6idnqxq9QAVYh8k4kJ+RP+6cqTdy7LjIm8xY/bQNpQIpGUAuDo2DjLcCDun9DAI4Q/3z+Q0o9QuQIDAQAB;
k3._domainkey.github.comPass:2048-bit RSA
Show record
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsYGiMSn7fsUqSvfSX40x9R1OlRtbNiCY80lHRIlcKx3XDIR7257aUx+q9CSIARdfTL6KCuLGNFx5g9TgVr6png4ajcieSQGtOehBgxnkDN8aAA5TX0FmFrcefJU0JoxLOF09EKgXxhSSHCk/ekVb0PXSboHXoZ9+EI404F1qhcwXXIgHXTaUthHTut2P6BBZhIXIgvDe/w49GchR7MRJqjNb7neEBbYHbgWuBTvvHCg7Gy6m6n9krYK+ROWq3dVvXy9plAGK3ygM+HtjIiMt7arRGMOF0WgDTz7YdN9BGpt6BvXxLnjiQcgS5T9n+cIyPZgiWzDMXNlaEEdKTEKxrwIDAQAB;
s1._domainkey.github.comPass:2048-bit RSA
Show record
k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyn3fMCVpb7ryIRKOGXhXVGYmsWUitNlSckqGHOwNFZgFadplOrD+Qzf1XQkP7MH/VB/97DsAAJGtEXW1Uq71Hjnfr/DuBN/YfjF/gU70qEFb7q1sdIiNtjFL2TkOpoW+X/bhhPNheW/fYwyFb6ZHFM6LTgXyuimWRHTOUP3VjZzhNVda79nt+2WZYbS4l8HdMgWpTNHjpVw5PtXESA9KBg/evSRk5fIaXIX5eRXW3baoV9yVzD8O29/IL/DiSk+yNvaO0EHL5c4yGuZJhGzvpiznb2IDVdemJK4Dqzdy5FTN/SGYZhAEr7MguG3Z314hMS2scgMsOMgB64uj/6+6UwIDAQAB
s2._domainkey.github.comPass:2048-bit RSA
Show record
k=rsa; t=s; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNt2/H6bKs99C6DAaokPp62KN9mKaD20D1PBakkObejkJvzM6Un/fKHPeI2/qXdvFFBPQE3mxMNoe+hwBVDgMgCuZEn8J6gZYI4amITure9/ny6+GaNVRoH2m6xAtWwKINkKxMayGiehkWlRVb7D23F0U8y+VDHKQFz1bnXA5jDpcDiMXy8i2lV5vEys+qt+1WGhDKCAwamT8c3xkZz8aXMJaXYCiN2HMgHDU81+mVCk4+u6mY+a98APVfFhsQ0KCq/mVZXaXTV06QrG9M5PtBHUFW7VtwXKp+AFrAut0KW1NnwaA5IGA5sc+n9dma7bSqdfGS+ixdSmJ69NwmYSHwIDAQAB

Selectors we checked (24)

google
selector1
selector2
default
dkim
mail
k1
k2
k3
s1
s2
smtp
mx
mandrill
mxvault
protonmail
protonmail2
fm1
fm2
sig1
zmail
kl
s1024
s2048

To check another selector, enter it as selector._domainkey.github.com.

MTA-STS, TLS reporting and BIMI

Optional records

MTA-STS

Not set up

No MTA-STS record. Sending servers may deliver mail to this domain without TLS when an attacker strips it.

TLS reporting

Not set up

No TLS-RPT record, so nobody hears about failed TLS connections to your mail servers.

BIMI

Not set up

No BIMI record, so inboxes that support it show no brand logo next to your mail.

Run this lookup from code

The API returns this result as JSON. The free plan includes 100 API calls per month.

curl "https://hostingchecker.online/api/v1/email-auth?query=github.com" \
  -H "Authorization: Bearer YOUR_API_KEY"

Get a free API key Read the API docs

View full analysis

How it works

How SPF works

When a server receives a message, it reads the domain in the envelope sender (the Return-Path) and looks up that domain's SPF record. If the sending server's IP address matches a mechanism in the record, SPF passes. If nothing matches, the all mechanism at the end decides the result.

SPF alone does not stop spoofing of the From address people see, because it checks the envelope sender only. DMARC closes that gap: it requires SPF or DKIM to pass for the same domain as the visible From address, and it tells receivers what to do when neither does.

ip4 / ip6: Allows an IPv4 or IPv6 address or range
include: Allows the servers in another domain's SPF record
a / mx: Allows the domain's own A or MX hosts
all: Matches everything else: -all fail, ~all soft fail
redirect: Uses another domain's SPF record instead

FAQ

SPF checker FAQ

Common questions about SPF records and why they fail.

Related guides

Learn more from the blog

Step-by-step guides on reading and using these results.

Related tools

More free tools

Explore our other free lookup and analysis tools.

Free lookup tool