Free SPF record checker
Look up the SPF record for any domain, count its DNS lookups against the limit of 10, and see every include it pulls in. Results in seconds, explained in plain language.
- Free, no sign-up
- Runs in your browser
- Follows every nested include
Lookups run in your browser against public DNS. We do not see or keep the domain you enter.
What is an SPF record?
An SPF record is a DNS TXT record that lists the servers allowed to send email for your domain. Receiving servers compare the sending server’s IP address with that list, and a match is an SPF pass.
SPF checks the hidden envelope sender, not the From address people see. That is why SPF needs DMARC before it can stop anyone impersonating your domain.
About this tool
- Lookups go from your browser to Google Public DNS, with Cloudflare as fallback. We never receive the domain.
- Includes are followed up to ten levels deep and counted the way receivers count them: include, a, mx, ptr, exists and redirect each cost one lookup.
- Records that use SPF macros are shown, but lookups inside a macro depend on each message and cannot be counted in advance.
What the checker tests
v=spf1One valid record
Exactly one SPF record with correct syntax. Two or more is a permanent error.
10The lookup limit
Receivers stop at 10 DNS lookups. One over and SPF fails for all your mail.
~allHow it ends
How unlisted servers are treated, and whether +all lets anyone send as you.
include:Broken parts
Includes that point nowhere, empty lookups and the deprecated ptr mechanism.
SPF questions
Short answers to what people ask most about SPF records.
What is the SPF 10 lookup limit?
SPF allows at most 10 DNS lookups while a record is evaluated. The include, a, mx, ptr and exists mechanisms and the redirect modifier each count, including those inside nested includes. Above 10, receivers return a permanent error and SPF fails, even for legitimate mail. ip4 and ip6 entries cost nothing.
Should I use ~all or -all?
Both are valid. ~all (soft fail) marks unlisted servers as suspicious, and -all (fail) says they are not authorised. Once DMARC is at p=reject, the DMARC policy decides what happens to failing mail, so ~all gives the same protection with less risk of rejections at servers that act on SPF alone.
Can a domain have two SPF records?
No. A domain may publish only one TXT record that starts with v=spf1. With two, receivers return a permanent error and SPF fails for every message. Merge all your services into one record with a single all at the end. Our SPF generator can load and rebuild your current record.
Does SPF stop email spoofing?
Not on its own. SPF checks the envelope sender, also called the Return-Path, which recipients never see. An attacker can pass SPF with their own domain while forging your name in the visible From line. DMARC closes that gap by requiring SPF or DKIM to pass for the same domain as the From address.
Why does SPF fail for forwarded email?
A forwarding server resends the message from its own IP address, which is not in your SPF record, so SPF fails at the final destination. DKIM signatures usually survive forwarding, which is why every service that sends as your domain should also sign with DKIM.
How do I fix too many SPF lookups?
Remove services you no longer use, replace includes with a provider’s published ip4 ranges where they are stable, and move bulk senders such as newsletter tools to a subdomain with its own SPF record. Treat automatic flattening with care, because provider IP ranges change. Our guide covers each option: SPF too many DNS lookups.
More free tools
Want SPF, DKIM and DMARC handled for you?
MailMarq finds every service sending as your domain, fixes SPF and DKIM for each one, and takes you to p=reject in stages you approve. Fully managed from R3,290 a year.