What is the SPF record type?
Modern SPF policies are stored in TXT records. DNSReach filters the response to show only the v=spf1 policy.
Common uses
- Reducing sender spoofing
- Authorizing email platforms
- Checking an email migration
What to enter
Enter the domain used in the sender address.
example.comHow to read the result
Mechanisms such as ip4, ip6, a, mx and include authorize senders. The final all qualifier defines how other senders are treated.
How SPF DNS lookups work
When a client requests a SPF record, it normally asks a recursive DNS resolver. The resolver may return a cached answer or contact the domain’s authoritative nameservers. Cached answers improve speed, but they also explain why a recent DNS change may not appear everywhere at exactly the same time.
DNSReach queries several independent public resolvers and, when possible, the authoritative nameservers for the domain. An authoritative answer reflects the zone currently published by the DNS provider. A recursive answer reflects what that resolver currently knows, which may still be an older cached value until its cache expires.
How to check a SPF record with DNSReach
- Open the DNS checker and select SPF.
- Enter
example.comin the format described above. - Run the check and watch each resolver return independently.
- Compare public resolver answers with the authoritative results marked by a shield.
- Investigate amber results because they differ from the authoritative or majority answer.
Why SPF answers can differ
The most common reason is caching. DNS records have a time to live, and resolvers that cached the previous value can continue serving it until that period ends. Differences can also come from split-horizon DNS, filtering policies, malformed responses, DNSSEC validation failures, resolver outages, or querying a hostname different from the one where the record is actually published.
A failed lookup is not always evidence that the entire domain is broken. “No record” means the requested type was not found at that exact name. A timeout means a resolver did not answer in time, while a refusal means it declined the query. Checking authoritative servers helps distinguish propagation delay from a configuration problem.
Common SPF troubleshooting steps
- Confirm the exact hostname and record type.
- Check the authoritative answer before changing the zone again.
- Allow existing cached answers to expire after a change.
- Verify that every authoritative nameserver publishes the same zone version.
- Review provider-specific formatting requirements and remove accidental duplicate records.
SPF record FAQ
What is the SPF record type?
Lists which systems are authorized to send email for a domain.
How do I check SPF records?
Enter example.com in DNSReach, select SPF, and run the check. DNSReach compares public recursive resolvers with available authoritative nameservers.
Why do DNS resolvers show different SPF answers?
Resolvers may hold cached data created at different times. A recent DNS change can therefore appear on some resolvers before others until older cached answers expire.
What does “no record” mean for SPF?
The resolver answered successfully but found no SPF record at the exact name queried. This can be normal when that record type is optional or published at another hostname.