Look up and validate the SPF TXT record on any domain: mechanisms, qualifiers, the all policy, and the 10 DNS lookup limit. It runs free in your browser over DNS-over-HTTPS, with no signup and nothing stored.
Create a free Unspam account to save your results and re-run these checks anytime, so you catch a broken setup before it costs you. No credit card.
SPF (Sender Policy Framework, defined in RFC 7208) is a published list of the servers allowed to send email for your domain. It lives as a single DNS TXT record on the sending domain that starts with v=spf1, followed by mechanisms that name authorized sources and a final all policy. When a mailbox provider receives a message, it checks the sending IP against the SPF record on the envelope (Return-Path) domain and uses the result as one signal for inbox placement. SPF is also one of the building blocks of DMARC, so a correct record is part of meeting the bulk sender requirements at Gmail, Yahoo, Outlook.com, and Apple.
Every valid SPF record begins with v=spf1. If the record does not start with this exact tag, or no TXT record is returned at all, the domain has no usable SPF policy.
These name the sources you authorize. include delegates to another domain's SPF (for example your email platform), a and mx authorize your own A and MX hosts, and ip4 / ip6 list specific addresses or CIDR ranges.
The mechanism at the end sets the default for everyone not listed: -all is a hard fail (recommended), ~all is a soft fail (common while testing), ?all is neutral, and +all authorizes anyone (do not use it).
SPF allows at most 10 DNS lookups during evaluation. Mechanisms like include, a, and mx each cost lookups, and nested includes add their own, so the checker follows the whole include chain to count the real total and flags records that go over the limit. Expand the breakdown to see which mechanism each lookup came from.
A domain must publish exactly one v=spf1 TXT record. If the checker finds two or more, the record is invalid and providers will return a PermError.
A domain may publish only one TXT record that starts with v=spf1. When a second one is added (often when a new email platform is set up), evaluation returns a PermError and SPF effectively fails. Merge every source into a single record with multiple include mechanisms.
Each include, a, mx, ptr, and exists mechanism triggers DNS lookups, and nested includes add their own. Once evaluation needs more than 10, the result is a PermError. Remove includes for platforms you no longer send from, or move a platform onto its own subdomain with its own record. Flattening an include into raw ip4 entries also works, but only for a provider that publishes stable addresses: Microsoft warns against flattening its own include, because the addresses behind it change and a flattened copy goes stale without telling you.
Ending the record with +all tells the world that every server is authorized to send as your domain, which disables SPF entirely and invites spoofing. Use -all for a hard fail, or ~all while you are still confirming your sources.
If the lookup returns nothing, or a TXT record that does not begin with v=spf1, the domain has no enforceable policy and DMARC has nothing to align against. Publish one record that starts with v=spf1 and ends with a restrictive all.
A single TXT string is capped at 255 characters. Long records must be broken into multiple quoted strings inside one TXT record (which is valid), not into separate records. Splitting into separate records creates the multiple-record error instead.
SPF authorizes the envelope sender in the Return-Path, not the address your reader sees. A message can pass SPF while displaying any From it likes, which is why DMARC alignment matters and SPF on its own proves very little.
Every date and figure Unspam publishes about sender requirements is kept here, checked against each provider’s own documentation. Last read August 16, 2026.
| Provider | What | Value | Applies to |
|---|---|---|---|
| Bulk sender rules in force since source | February 2024 required | mail to personal Gmail addresses | |
| Enforcement tightening since source | November 2025 observed Google calls this gradual and progressive rather than a switch that flipped on a date. | mail to personal Gmail addresses | |
| Counts as a bulk sender at source | 5,000 required This is Google’s number. Yahoo declines to publish one at all. | mail to personal Gmail addresses | |
| Spam complaint rate ceiling source | 0.3% required Google describes the effect as graduated rather than a cutoff: above the recommended figure inbox placement already suffers, and at the ceiling it suffers more. | every sender to Gmail, not only bulk | |
| Spam complaint rate to aim for source | 0.1% recommended Postmaster Tools does not divide complaints by everything you sent. It measures them against DKIM-signed messages that reached an engaged recipient’s inbox, so a sender already being filtered can see an artificially low rate. | every sender to Gmail, not only bulk | |
| Yahoo | Bulk sender rules in force since source | February 2024 required | mail to Yahoo, AOL and Yahoo’s other mailboxes |
| Counts as a bulk sender at source | not published Yahoo states it will not specify a volume threshold, so no figure can be attributed to it. | mail to Yahoo, AOL and Yahoo’s other mailboxes | |
| Spam complaint rate ceiling source | 0.3% required | mail to Yahoo, AOL and Yahoo’s other mailboxes | |
| Outlook.com | Bulk sender rules in force since source | May 2025 required | Outlook.com and Microsoft’s other consumer mailboxes, never a Microsoft 365 tenant |
| Counts as a bulk sender at source | 5,000 required The rule applies to any domain that has ever crossed the threshold, so it keeps applying on a quieter day. | Outlook.com and Microsoft’s other consumer mailboxes, never a Microsoft 365 tenant | |
| What happens to failing mail source | 550 5.7.515 observed Failing mail is refused during the SMTP conversation rather than filed in a spam folder. Microsoft’s postmaster policy page still describes junk foldering as a first step, so a sender may see either, but the bounce is the outcome to plan for. | Outlook.com and Microsoft’s other consumer mailboxes, never a Microsoft 365 tenant | |
| SPF and DKIM must both pass, not just DMARC source | required Stricter than DMARC alone. DMARC passes when either SPF or DKIM aligns, and Outlook.com asks for both checks to pass on top of that. | Outlook.com and Microsoft’s other consumer mailboxes, never a Microsoft 365 tenant | |
| Apple | Bulk sender rules in force since source | February 2025 required | mail to iCloud Mail, me.com and mac.com |
| ARC headers on forwarded mail source | required Apple is the only one of the four to ask for this, which is the honest reason to look at ARC at all. | mail to iCloud Mail, me.com and mac.com |
Unspam reads all of these from your domain name alone.
No DNS lookup can reach these. They need a real message or real sending history, which is what an inbox placement test is for.
