Is SPF enough to stop spoofing?

No. SPF checks the hidden envelope sender, not the From address people see. You need DMARC as well; it ties SPF and DKIM to the visible From address.

How long does a change to my SPF record take?

Usually minutes to a few hours, depending on the TTL of the record. Run the check again after the change.

Do I need SPF on a domain that never sends email?

Yes. Publish “v=spf1 -all” and a DMARC record with p=reject, so nobody can send mail in its name.

SPF record checker

Check the SPF record of any domain. We test the syntax, count DNS lookups against the limit of 10 and tell you exactly what to change. DKIM, DMARC and MTA-STS are checked in the same report.

What is SPF?

SPF (Sender Policy Framework) is a TXT record in your DNS that lists which servers may send email for your domain. Receiving mail servers compare the sending server with that list. A record looks like this:

v=spf1 include:spf.protection.outlook.com include:_spf.google.com -all

The most common SPF mistakes

Two SPF records. A domain may have only one record that starts with v=spf1. With two, receivers treat SPF as broken. Merge them into one.

More than 10 DNS lookups. Every include, a, mx and redirect costs a lookup, including the ones inside other includes. Above 10, SPF fails. Remove services you no longer use or ask your provider for a flattened include.

+all at the end. This allows every server in the world to send as you. Use -all (reject) or ~all (soft fail).

Forgetting a sender. Newsletters, invoicing software and your website’s contact form often send in your name. Add each of them, or their mail will land in spam.

~all or -all?

~all asks receivers to accept but mark mail from other servers; -all asks them to reject it. With DMARC in place the difference is small, because DMARC decides what happens. Start with ~all, switch to -all once you know all your senders.

Questions

Is SPF enough to stop spoofing?: No. SPF checks the hidden envelope sender, not the From address people see. You need DMARC as well; it ties SPF and DKIM to the visible From address.
How long does a change to my SPF record take?: Usually minutes to a few hours, depending on the TTL of the record. Run the check again after the change.
Do I need SPF on a domain that never sends email?: Yes. Publish “v=spf1 -all” and a DMARC record with p=reject, so nobody can send mail in its name.

OZAG Technologies · KVK 42167370 · Laan van Oversteen 20, 2289 CX Rijswijk · +31 6 24496620 · support@ozagsecurity.com