Paste raw email headers to analyze the sender, routing path, and security protocols.
Upload and analyze DMARC aggregate reports (.xml, .zip, or .gz, max 10 MB).
Upload and analyze TLS-RPT (TLS Reporting) JSON reports (.json, .zip, or .gz, max 10 MB).
Create an SPF TXT record for your domain, including Microsoft 365, Google Workspace, IP addresses, wildcard SPF and automatic SPF macros.
SPF stands for Sender Policy Framework. It is a DNS TXT record that tells which mail servers are allowed to send email on behalf of a domain.
A simple Microsoft 365 SPF record often looks like this:v=spf1 include:spf.protection.outlook.com -all
What do you choose here?
DNS hostname decides which name the SPF record applies to. Use @ when the domain sends mail as [email protected]. Use a subdomain such as mail or support when the SPF record should apply to mail.example.com or support.example.com.
The final SPF policy decides what receivers should do with senders that do not match the rules. Use ~all while discovering/testing senders, -all when all legitimate senders are included, and ?all only if you intentionally want a neutral result.
What should be added as senders?
Only add services that actually send email on behalf of the domain. Typical senders are Microsoft 365, Google Workspace, newsletters, CRM, invoicing systems, web servers and own SMTP servers.
Use include when the provider gives you an SPF domain. Use ip4/ip6 when you have fixed sender IP addresses. Use a or mx only if you know the web server or MX servers actually send outbound email.
How do SPF macros work?
An SPF macro is a placeholder expanded by the receiving mail server while SPF is evaluated. This lets SPF perform dynamic DNS lookups based on sender IP, checked domain, sender address or HELO name.
The common choice is include when you want to reference another SPF policy or SPF zone. Choose exists when you need a dynamic DNS lookup to decide whether the sender is authorized. Choose redirect only if the full SPF policy should be delegated to another name. Choose exp if you want to point to explanatory text for SPF fail.
A common choice is exists + %{i} + _spf.example.com, which becomes exists:%{i}._spf.example.com. Use %{ir} if the zone expects reversed IP format. Normal Microsoft 365 domains usually do not need SPF macros.
Automatically generated macro expression:
Selected SPF macros:
Why use wildcard SPF?
SPF on @ applies to the root domain, but does not always protect random subdomains. An attacker may try to send from [email protected]. Wildcard SPF says unknown subdomains are not allowed to send email.
The recommended choice is to enable wildcard SPF if you do not have many subdomains that send email. If a real subdomain sends email later, create its own SPF record directly on that subdomain.
DNS record for selected hostname:
Wildcard SPF, if selected:
Only one SPF record per hostname
Do not add multiple TXT records starting with v=spf1 on the same hostname.
Maximum 10 DNS lookups
include, a, mx, exists and redirect count toward the 10 DNS lookup limit.
Do not use ptr
ptr is slow, unreliable and not recommended in modern SPF setups.