Are SPF records public?
Short answer
Yes, Sender Policy Framework (SPF) records are completely public. SPF records are published as text (TXT) records in your domain's public Domain Name System (DNS). Receiving mail servers must query your DNS records freely to confirm whether an incoming message originated from an authorized sending server or IP address. Because public DNS records are accessible to anyone on the internet, anyone can inspect your SPF configuration.
The details
Public visibility is a necessary requirement for email authentication. When a server receives an email claiming to come from your domain, it executes a DNS query to retrieve your SPF record and inspects the approved IP addresses or third-party email providers. Major mail services, including personal Gmail accounts as described in Google Workspace: Email sender guidelines, check these records to block unauthenticated or spoofed messages. Without public access, external mail transfer agents could not validate incoming messages.
Because your SPF record is visible to the world, anyone can inspect which third-party marketing tools, CRM platforms, and infrastructure services send mail on your behalf. Attackers sometimes review SPF records during initial reconnaissance to identify software vendors your organization uses. However, SPF alone cannot fully protect your domain from spoofing in end-user display headers. Industry standards outlined by DMARC.org Overview emphasize using SPF alongside DKIM and a strict DMARC policy.
A common mistake when managing public SPF records is leaving decommissioned mail platforms or former SaaS vendors inside your include mechanisms. Because these records are open to external inspection, adversaries can identify stale third-party services and check whether orphaned sending domains or dangling IP ranges can be reclaimed. To reduce this exposure, audit SPF entries quarterly, verify that every included hostname actively routes mail for your organization, and prune unused providers immediately.
What to do
- Open your computer's terminal or command prompt.
- Run nslookup -type=TXT yourdomain.com or dig yourdomain.com TXT.
- Locate the record beginning with v=spf1 in the output.
- Review the listed IP addresses and third-party mail providers for accuracy.
- Ensure obsolete services or former vendors are promptly removed from the record.
Useful next reads and tools
Terms explained
- SPF
- SPF (Sender Policy Framework) is a DNS record listing the servers allowed to send email for a domain.
- DKIM
- DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing email so receivers can verify it came from an authorized sender for the domain and was not altered in transit.
- DMARC
- DMARC is a DNS policy that tells receiving mail servers what to do with email that fails SPF and DKIM alignment for your domain, and where to send reports about it.
- HTTPS and TLS
- HTTPS is HTTP protected by TLS encryption, which keeps data between a browser and a website private and tamper-resistant and confirms the site controls its domain.
Sources
Related questions
- What are SPF, DKIM and DMARC?
- How do I stop someone from spoofing my email domain?
- How do I read email headers to check if a message is fake?
- What are HTTP security headers and which ones should my website have?
- How can I check if my website is secure?
- What is a DDoS attack and how do I protect a website from one?