Guide

SPF record not working? How to fix common SPF syntax errors

If your SPF record is not working, it is usually a syntax error, a lookup limit issue, or a missing mechanism. Here is how to diagnose and fix it.

Check your SPF record in seconds

The free InboxProof SPF checker validates your SPF record against the RFC 7208 syntax, checks the 10-DNS-lookup limit, and tells you exactly what is wrong. No signup.

Run the free check

How to verify your SPF record exists

First, make sure your SPF record is actually published. Run this command:

dig TXT yourdomain.com

If you do not see an SPF record, you need to create one. If you do see one but it is not working, continue below.

Common SPF syntax errors

Missing "v=spf1" prefix

Every SPF record must start with v=spf1. If it is missing, the record is invalid and will be ignored.

Missing "-all" or "~all" modifier

Your SPF record should end with -all (hard fail) or ~all (soft fail). Without it, the record is incomplete and may not be enforced.

Too many DNS lookups

SPF has a 10-DNS-lookup limit. Each include:, a, mx, or ptr mechanism counts as one or more lookups. If you exceed 10, the record "permerrors" and is treated as a failure.

Multiple SPF records

A domain can have only one SPF record. If you have two TXT records that both start with v=spf1, the receiving server will "permerror" and treat the record as a failure.

Invalid mechanism syntax

Mechanisms like ip4:, ip6:, a, mx, and include: have specific syntax. A typo (e.g., ip4:1.2.3.4/24 instead of ip4:1.2.3.4/24) will cause a syntax error.

How to fix it

Run the free SPF checker. It will tell you exactly what is wrong.
Fix the syntax. Make sure the record starts with v=spf1 and ends with -all or ~all.
Reduce DNS lookups. Replace include: chains with ip4: or ip6: mechanisms where possible.
Remove duplicate records. If you have two SPF records, consolidate them into one.
Verify the fix. Run the checker again to confirm the record is valid.

What a good SPF record looks like

v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.5 -all

This record says: "Allow Google, SendGrid, and the IP 203.0.113.5 to send email on behalf of this domain. Reject everything else."

Check your SPF record now

Run the free SPF checker and see exactly what is wrong.

Run the free check

Want this checked automatically every day? Inboxproof Pro monitors your domain around the clock and alerts you the moment a record breaks or an IP gets listed. See pricing →