SPF record checker

Type a domain to look up its SPF record. Each part is explained in plain words, and the faults that break delivery are flagged.

Free, with no sign-up.

What SPF is

SPF (Sender Policy Framework) is a TXT record that lists the servers allowed to send email for a domain. A receiving mail server looks it up and compares it with the server that delivered the message.

v=spf1 include:_spf.google.com ip4:203.0.113.25 ~all

This one says: allow Google's servers, allow the address 203.0.113.25, and treat mail from anyone else as suspicious.

The parts of an SPF record

PartMeaning
v=spf1Marks the record as SPF. It must come first.
include:nameAlso allow whatever that domain's SPF record allows. Used for mail providers.
ip4: / ip6:Allow one address or a range.
a / mxAllow the servers in the domain's A or MX records.
-allEveryone else fails. Receivers may reject the mail.
~allEveryone else soft-fails. The mail is accepted but marked.
+allEveryone passes. Never use it: it allows the whole internet.

What this checker flags

  • No SPF record. Anyone can send mail claiming to be from the domain.
  • More than one SPF record. Receivers treat this as a permanent error, and the check fails for all mail.
  • More than 10 lookups. Each include, a, mx, exists and redirect costs a DNS lookup. Above 10 the check fails. This tool counts the top level only, and included records add their own.
  • No all at the end. The record does not say what to do with other senders.
  • +all. It cancels the protection.
Full guide: DNS records explained

Common questions

Can a domain have two SPF records?+
No. It must have exactly one TXT record that starts with v=spf1. If you use two mail services, put both in one record: v=spf1 include:first.example include:second.example ~all
Should I use ~all or -all?+
Start with ~all while you find every service that sends mail as your domain. Move to -all once you are sure the list is complete. With a DMARC policy in place, both are handled the same way by most large receivers.
SPF passes but my mail still fails DMARC. Why?+
SPF checks the hidden return address of the message, not the From address people see. DMARC also needs the two domains to match. A newsletter service that uses its own return address passes SPF for its domain, not yours. Set up DKIM signing with your domain there.
What is the 10 lookup limit?+
The SPF standard (RFC 7208) lets a receiver do at most 10 DNS lookups while checking a record, to prevent abuse. Records that need more fail with a permanent error. Remove services you no longer use, or replace an include with the ip4 ranges it resolves to.

More free tools

A tool checks once. A monitor checks every minute.

PULSX watches your site, DNS, SSL certificate and cron jobs every 60 seconds and alerts you when one fails. Free for 20 monitors, with no card.

Create a free accountSee what it checks