Key points at a glance
- SPF lists in the DNS the servers allowed to send emails for your domain.
- There may only be one SPF record, and it may trigger at most 10 DNS lookups.
- SPF alone does not protect against spoofed senders in the mailbox – that takes DMARC.
What SPF does
With SPF (Sender Policy Framework, RFC 7208) you publish a list in the DNS of the servers allowed to send emails for your domain. The receiving server checks whether the email comes from one of these servers. Example: example.com TXT “v=spf1 include:_spf.example.net -all”.
- Email arrivesThe recipient sees the technical sender domain and the address of the sending server.
- DNS lookupIt reads that domain’s SPF record.
- ComparisonIs the sending server on the list?
- ResultMatch: passed. Otherwise the final rule applies, -all or ~all.
The key building blocks
- include: takes over the list of a service, such as your mail provider or newsletter tool.
- ip4 and ip6: allow individual addresses or networks.
- a and mx: allow the servers behind the A or MX record.
- -all (hard) or ~all (soft): defines what happens with all remaining servers.
Free domain check
Is your company address protected?
Enter your domain or your email address. You see the result right here, with a traffic light and a grade from A to F.
You opened a link to a result. The check only starts when you click, always with the current state.
Privacy: if you enter an email address, we transmit only the domain; the part before the @ never leaves your browser. We use the domain only for this check of public DNS records and do not store it in plain text; we do not store the result. We store your IP address only as a checksum and for at most one day to curb abuse.
The quick check is based on public DNS data at the time of the query and does not replace a full review; no warranty.
Keep an eye on it continuously instead of checking once:
Book a free initial callMonitor your domain – 14 days freePrefer some help? Ask us to set it up- No commitment
- No credit card
- Ends on its own after 14 days
No-obligation request by email · price on request
What happens next
- Your email program opens a prepared request with your domain. Add your name and send it.
- We get back to you and discuss with you or your IT partner which records (SPF, DKIM, DMARC) are needed and what the setup costs.
- The setup needs access to the DNS management of your domain. We agree the handover with you – please never send us passwords by email.
- If you wish, DomainRadar then monitors your domain continuously and alerts you when something changes.
No email program opens? Write to us with your domain at info@domainradar.ch.
Good to know: this protection stops anyone forging exactly your domain. Against look-alike addresses, always confirm payment changes by phone.
All checks
Quick check based on public DNS records. Continuous monitoring also checks certificates, blocklists and your DMARC reports.
Your result as a PDF
As a report to keep or to forward to your IT.
Free and without an account: you confirm your address by email and can unsubscribe at any time.
The three most common mistakes
- More than one SPF record: there must be exactly one, otherwise SPF is invalid.
- More than 10 DNS lookups: every include counts, including nested ones. From the eleventh lookup, SPF counts as an error (“permerror”).
- Forgotten services: a shop, CRM or ticketing system sends in your name but is not listed in the record.
Watch the limit of 10 lookups
Including many services via include quickly exceeds the limit. SPF then becomes invalid and no longer helps any of your emails – not even the genuine ones.
Why SPF alone is not enough
SPF only checks the technical sender address (return path), not the address shown in the mailbox. A fraudster can therefore send an email with your visible address that passes SPF for their own domain. SPF also breaks when an email is forwarded. Only DMARC links SPF to the visible address.
Tip for domains that send no mail
Protect domains that never send email with “v=spf1 -all”. That way, every recipient knows no genuine email ever comes from that domain.
How DomainRadar helps
DomainRadar continuously checks your SPF record, counts the DNS lookups, detects duplicate or invalid records and notifies you when something changes. If the limit gets tight, DomainRadar suggests how to save lookups.
The domain check stays free. Afterwards you test DomainRadar with all features for 14 days – no credit card, the trial ends on its own.