SPF Checker

Check a domain's SPF record — syntax, multiple-record conflicts, and common misconfigurations.

What is an SPF checker?

An SPF checker reads a domain's Sender Policy Framework record and tells you whether it is set up correctly. SPF is a TXT record in DNS that lists the servers allowed to send email for the domain. Receiving mail servers compare the sending server with that list, which makes it harder for others to send email pretending to be you and helps your genuine mail reach the inbox.

This tool finds the record, splits it into its parts, counts its DNS lookups and points out the mistakes that most often break SPF.

How the SPF check works

The tool looks up the domain's TXT records and picks out those starting with v=spf1. It then runs four checks:

Exactly one record: the SPF standard, RFC 7208, allows only one. Two or more cause SPF to fail with a permanent error.
DNS lookup count: mechanisms that need extra lookups, such as include, a, mx, exists, redirect and ptr, are counted against the limit of 10.
No +all: this allows every server in the world to send as the domain.
An all mechanism: without one, there is no defined result for unlisted senders.

The count covers the mechanisms in the record itself. Each include can contain further lookups of its own, so the real total may be higher.

How to check your SPF record

Enter the domain you send email from, for example example.com.
Press Check SPF.
Read the status, the record and the lookup count.
Review the parsed mechanisms and the findings for anything to fix.

Reading your SPF results

Mechanisms

Each part of the record is listed with its type and value. ip4 and ip6 name addresses directly, include pulls in a provider's list, and a and mx allow the domain's own web or mail server addresses.

Qualifiers

The symbol in front of each mechanism decides the result for a match: + Pass, - Fail (hard fail), ~ SoftFail and ? Neutral. A record usually ends with ~all or -all, which says how to treat everyone not listed.

An example SPF record

A domain that sends through Google Workspace and a newsletter service might publish:

v=spf1 include:_spf.google.com include:newsletter.example.net -all

This allows Google's servers and the newsletter provider's servers, and tells receivers to fail everything else. Your providers give you the exact include values to use.

SPF, forwarding and DMARC

SPF checks the server that hands a message over, so it can fail when mail is forwarded, because the forwarding server is not in your record. That is one reason DKIM matters too: its signature travels with the message. DMARC accepts a message when either SPF or DKIM passes and matches the From domain, which keeps forwarded mail working when DKIM is set up.

Common uses

Checking SPF after adding a new email or marketing service.
Finding out why messages fail SPF or land in spam.
Confirming a domain that never sends email is protected.
Spotting old include entries left behind by services you no longer use.

Common problems and fixes

Multiple SPF records. Merge them into one record that contains every include and address, then delete the extras.

Too many DNS lookups. Remove services you no longer use, replace a or mx with direct ip4 addresses where they rarely change, and avoid ptr.

No SPF record. Add one TXT record at the domain root. For a domain that sends no email at all, v=spf1 -all is enough.

Related tools

DMARC Checker checks the policy that builds on SPF.
DKIM Checker checks your email signing key.
Email Health Checker scores SPF with DMARC, MX and reverse DNS.
DNS Lookup shows all of a domain's TXT records.

Frequently asked questions

What does an SPF record do?

An SPF record lists the servers allowed to send email for your domain. Receiving mail servers check whether a message came from one of those servers. Mail from an unlisted server can be marked as suspicious or rejected, which makes it harder for others to send email pretending to be you.

Can a domain have more than one SPF record?

No. The SPF standard allows exactly one SPF record per domain. If two or more exist, receiving servers return a permanent error and SPF fails for all of your mail. Combine everything into a single record that lists every service you send through.

What is the SPF 10 lookup limit?

SPF allows at most 10 DNS lookups while a receiving server evaluates the record. Mechanisms such as include, a, mx, exists, redirect and ptr each use lookups, and includes can contain more of their own. Going over the limit causes a permanent error, so SPF fails even for genuine mail.

Should I use ~all or -all?

Use ~all, SoftFail, while you are still confirming that every sending service is listed. Once you are confident, -all, hard fail, tells receivers to treat unlisted senders as failures. With DMARC in place, either works well, because DMARC decides what happens to messages that fail.

Why is +all dangerous in an SPF record?

The +all mechanism tells receivers that every server on the internet may send email for your domain. That makes the SPF record useless for stopping spoofing and can harm your reputation. It is almost always a mistake, so replace it with ~all or -all.

Do I need SPF if my domain does not send email?

Yes, it is a good idea. Publishing v=spf1 -all tells receivers that no server is allowed to send for the domain, which stops spammers from using it. Pair it with a DMARC record set to p=reject for full protection of a domain that never sends mail.

Why does my SPF record pass here but mail still fails SPF?

This tool checks the record itself. A message can still fail if it was sent through a server or service not listed in the record, or if forwarding changed the sending server. Look at the authentication results in the failed message's headers to see which server sent it.