Key points at a glance
- Each domain has exactly one SPF record; it starts with v=spf1.
- It may trigger at most 10 further DNS lookups, otherwise the check fails.
- It ends with -all or ~all, never +all.
Step 1: find the record
The SPF record is a TXT record directly on your domain. The quickest way to see it is with our free domain check. In a terminal: on Windows “nslookup -type=txt example.com”, on macOS and Linux “dig txt example.com +short”. Look for the line starting with v=spf1.
- Find the recordThe domain’s TXT record, starts with v=spf1.
- Match sendersAll services that send in your name should be listed.
- Check the limitsOne record, at most 10 further lookups.
- Check the endingEnds with -all or ~all.
Step 2: list all senders
Think of every service that sends email with your domain: your mailbox provider, the newsletter service, accounting, the online shop or the ticketing system. Each service names the right include entry in its own instructions.
- Microsoft 365: v=spf1 include:spf.protection.outlook.com -all
- Google Workspace: v=spf1 include:_spf.google.com ~all
- Several services: v=spf1 include:spf.protection.outlook.com include:<service> -all
- Domain without email: v=spf1 -all
Free domain check
Is your company address protected?
Enter your domain or your email address. You see the result right here, with a traffic light and a grade from A to F.
You opened a link to a result. The check only starts when you click, always with the current state.
Privacy: if you enter an email address, we transmit only the domain; the part before the @ never leaves your browser. We use the domain only for this check of public DNS records and do not store it in plain text; we do not store the result. We store your IP address only as a checksum and for at most one day to curb abuse.
The quick check is based on public DNS data at the time of the query and does not replace a full review; no warranty.
Keep an eye on it continuously instead of checking once:
Book a free initial callMonitor your domain – 14 days freePrefer some help? Ask us to set it up- No commitment
- No credit card
- Ends on its own after 14 days
No-obligation request by email · price on request
What happens next
- Your email program opens a prepared request with your domain. Add your name and send it.
- We get back to you and discuss with you or your IT partner which records (SPF, DKIM, DMARC) are needed and what the setup costs.
- The setup needs access to the DNS management of your domain. We agree the handover with you – please never send us passwords by email.
- If you wish, DomainRadar then monitors your domain continuously and alerts you when something changes.
No email program opens? Write to us with your domain at info@domainradar.ch.
Good to know: this protection stops anyone forging exactly your domain. Against look-alike addresses, always confirm payment changes by phone.
All checks
Quick check based on public DNS records. Continuous monitoring also checks certificates, blocklists and your DMARC reports.
Your result as a PDF
As a report to keep or to forward to your IT.
Free and without an account: you confirm your address by email and can unsubscribe at any time.
Common mistakes
- Two SPF records on the same domain: this makes SPF invalid. Combine everything into one record.
- More than 10 lookups: every include, a, mx, exists and redirect counts, including nested ones. Remove services you no longer use.
- +all at the end: this lets any server in the world send in your name.
- Outdated ptr: the standard advises against it; replace it with include or ip4.
Add first, then tighten
Only switch to -all once every genuine sender is listed in the record. Otherwise recipients will reject your own emails.
Why SPF alone is not enough
SPF only checks the invisible sender address used for sending, not the sender shown in the mailbox. SPF also often fails on forwarded email. Only together with DKIM and DMARC does SPF effectively protect your domain against forgery.
Frequently asked questions
Should I use -all or ~all?
With DMARC, its policy mainly decides what happens to forgeries. -all is the stricter choice once every sender is listed; ~all is common for the transition period.
How long does it take for a change to take effect?
Usually a few minutes to a few hours, depending on the record’s time to live (TTL).
Do I need SPF on subdomains?
Only on subdomains that send email themselves. Every sending subdomain needs its own SPF record.
How DomainRadar helps
DomainRadar checks your SPF record continuously, counts the DNS lookups, and reports when a sender is missing or the record becomes invalid. In the DMARC reports you can see which services really send in your name.
The domain check stays free. Afterwards you test DomainRadar with all features for 14 days – no credit card, the trial ends on its own.