Free SPF Record Checker
Find and validate the SPF record for any domain, follow every include and see whether it breaks the lookup limit. No account needed.
Free, with no sign-up. Fair-use limits apply. To enforce them we keep the domain you enter and a scrambled form of your IP address for 30 days, as described in our privacy policy.
What SPF does and why it matters
SPF, the Sender Policy Framework, is a single line of text published in your domain’s DNS that lists the servers allowed to send email on your behalf. Receiving mail servers look it up when a message arrives, and if the sending server is not on the list, the message may be marked as spam or rejected. It is one of the three pillars of email authentication, alongside DKIM and DMARC, and mailbox providers increasingly expect all three from anyone who sends in volume.
The record looks simple, but it is easy to get subtly wrong. This free checker finds your SPF record, validates it and explains what it says, so you can fix problems before they cost you delivered email.
How to use the checker
Enter your domain and press Check SPF. The tool finds the record, checks the syntax, and then follows every include and redirect it contains, building the same tree of lookups that a receiving mail server would build. You get a plain-English reading of the policy and a list of anything that needs attention.
The 10 lookup limit and other traps
The specification allows at most ten DNS lookups while evaluating an SPF record. Every include, a, mx, ptr and exists mechanism counts towards that limit, and includes inside includes count too. Add a few email services, a marketing platform and a helpdesk, and it is surprisingly easy to go over. When a record exceeds the limit the result is a permanent error, and many receivers treat that as a failure even though the record looks fine when you read it.
The checker counts the lookups for you, and it also looks for the other classic mistakes:
- More than one SPF record on the same domain, which is invalid and causes a permanent error.
- Mechanisms that point at names that do not exist, known as void lookups, where too many are also an error.
- Includes that loop back on themselves.
- A record ending in +all, which allows anyone in the world to send as you.
- A record with no final all mechanism, which leaves the policy undecided.
- The deprecated ptr mechanism, which is slow and discouraged.
Understanding the qualifiers
The last part of a record says what to do with mail from servers that are not listed. A dash (-all) means fail, so unlisted senders should be rejected. A tilde (~all) means soft fail, so unlisted mail is accepted but treated with suspicion. A question mark (?all) means neutral, which says nothing useful. Most domains are best served by -all or ~all once every legitimate sender has been added, and the checker explains which you have and what it means in practice.
Fixing what it finds
If you are over the lookup limit, remove services you no longer use first, then consider replacing includes with the sending IP ranges directly, a technique known as flattening. If you have two records, merge them into one. If a new service is not covered, add its include before the final all. Change one thing at a time and test again, because an SPF mistake can silently block real email.
SPF only proves that the sending server is allowed. It says nothing about the visible From address, which is why DMARC exists. Check your DMARC record next, and use the DKIM checker to confirm your signing key is published.
Keep it checked automatically
SPF records change whenever someone adds a new email service, and nobody tests the lookup count afterwards. An SEO Web Data account can watch your domain every week and alert you if the SPF record is changed or removed. It also includes an SPF generator, a full email authentication checker and more than seventy other domain tools. Every plan starts with a free trial.
Frequently asked questions
Can a domain have two SPF records?
No. Two records make SPF invalid. Combine them into one record with all the includes you need.
Does SPF stop spoofing on its own?
Not fully. SPF checks the hidden envelope sender, not the From address people see. DMARC ties the two together.
Why does my record pass here but fail elsewhere?
The most common cause is the lookup limit, which depends on how deep the include tree goes at the moment of the check.
Do subdomains need their own SPF record?
A subdomain that sends email needs its own record. Subdomains that never send can publish a record that rejects everything.
More free tools
See all free domain tools, or read how the email authentication tools work inside the dashboard.