What does SPF PASS mean?

SPF PASS means the sending IP address is listed as authorized in the domain's SPF record. The receiving mail server should accept the message as coming from a legitimate source.

What is the difference between SPF FAIL and SOFTFAIL?

SPF FAIL (-all) means the domain explicitly says the IP is not authorized and the message should be rejected. SPF SOFTFAIL (~all) means the IP is not authorized but the domain is not asking for a hard reject — receiving servers may accept the message but treat it with suspicion.

Why does my SPF check return NONE?

NONE means no SPF record was found for the domain. You need to add a TXT record at the root of your domain starting with v=spf1. Use the InboxGreen SPF Generator to build the correct record for your sending providers.

How many DNS lookups does SPF allow?

The SPF specification allows a maximum of 10 DNS lookups per evaluation. Each include:, a:, and mx: mechanism counts as one lookup. If you exceed 10, some receivers will return a PERMERROR result and reject the message.

SPF Tester

Built for operators & agencies

Live DNS - no cached APIs

No login required

No data retention

Privacy first diagnostics

Prevents blacklisting - not causes it

Test whether a specific IP address is authorized to send email for your domain according to your SPF record. Shows which mechanism matched and the final SPF verdict.

What does the SPF verdict mean?

PASS	The IP is authorized. Email should be accepted.
SOFTFAIL	The IP is not listed but the domain uses ~all. Email may be accepted with suspicion.
FAIL	The IP is not authorized. The domain uses -all and email should be rejected.
NEUTRAL	The domain uses ?all — makes no assertion about the IP.
NONE	No SPF record found for the domain.

When is this useful?

Verifying your mail server's IP is included in your SPF record before going live
Diagnosing why a specific server's emails are failing SPF at the receiving end
Testing after adding a new sender like Mailchimp, SendGrid, or a transactional API
Confirming that a third-party IP is covered by an include: mechanism

How SPF works

SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are authorized to send email for your domain. When a receiving mail server gets a message, it checks the envelope sender's domain against its SPF record and compares the sending IP against the listed mechanisms.

SPF mechanism types

ip4: and ip6: — match a specific IP address or CIDR range directly.
include: — recursively checks the SPF record of another domain.
a: — matches if the sending IP resolves to the domain's A or AAAA record.
mx: — matches if the sending IP is one of the domain's MX servers.
all — catch-all at the end. ~all = softfail, -all = fail, ?all = neutral, +all = pass everything (not recommended).

The SPF record is evaluated left to right. The first mechanism that matches the sending IP determines the verdict. If no mechanism matches before all, the all qualifier is used.

Common SPF mistakes

Having more than one SPF TXT record. You must merge all mechanisms into a single record.
Exceeding 10 DNS lookups (each include, a, mx counts as one).
Forgetting to add a new sender's include after switching email platforms.
Using -all before verifying all legitimate senders are covered.

Free Deliverability Scan

Check SPF, DKIM, DMARC and List-Unsubscribe for your domain in seconds.