Free SPF checker, no signup. Enter a domain name to read its SPF record, see what each part allows, and count its DNS lookups against the limit of 10. The check runs in your browser against public DNS.
What This SPF Checker Tells You
- The SPF record as published in DNS.
- Each term explained in one line: which servers it allows and what it costs.
- The DNS lookup count, including the lookups hidden inside every
include. - The records it pulls in, shown as a tree.
- The errors that break SPF: no record, two records, more than 10 lookups, a typo,
+all.
How to Read an SPF Record
An SPF record is a TXT record that starts with v=spf1. It lists the servers allowed to send mail for the domain and ends with a rule for everyone else.
| Term | What it does | DNS lookups |
|---|---|---|
ip4: / ip6: | Allows an address or a range. | 0 |
include: | Allows the servers of another domain’s SPF record. | 1, plus those inside |
a | Allows the domain’s own addresses. | 1 |
mx | Allows the domain’s mail servers. | 1 |
exists: | Passes when a name resolves. | 1 |
redirect= | Uses another domain’s record in place of this one. | 1, plus those inside |
ptr | Reverse-DNS match. The standard says not to use it. | 1 |
-all | Every other server fails. | 0 |
~all | Every other server soft-fails. | 0 |
?all | No statement about other servers. | 0 |
+all | Every server passes. It cancels the record. | 0 |
The 10-Lookup Limit
A receiver may make 10 DNS lookups to evaluate an SPF record, and no more (RFC 7208). Past 10, it stops and returns an error. Mail then fails SPF even when it comes from an allowed server.
The limit is easy to hit. Each include costs one lookup, and the record it points to often has its own. One mail provider and three sending tools can already reach 10. This checker follows every include and shows the total.
The Errors That Break SPF
- Two SPF records. A domain must publish exactly one. With two, receivers return an error. Merge them into one record.
- More than 10 lookups. Remove the services you no longer use, or replace an
includewith the provider’s address ranges. - A typo. One unknown term makes the whole record invalid.
+all. It allows every server on the internet.- An include that points nowhere. If the included domain has no SPF record, the check ends in an error.
-all or ~all?
-all tells receivers to fail mail from any other server. ~all asks them to accept it and treat it as suspicious. Once a DMARC record is in place, the two behave much the same, because DMARC decides what happens to a failure.
After the SPF Check
SPF is one of three records. Check the other two with the DMARC Checker and the DKIM Checker, and see where the domain’s mail arrives with the MX Lookup. The SPF, DKIM and DMARC guide explains how they work together.
Frequently Asked Questions
What is an SPF record?
An SPF record is a DNS TXT record that starts with v=spf1 and lists the servers allowed to send email for a domain. Receiving servers read it to decide whether a message comes from an authorized server.
How do I check an SPF record?
Enter the domain in the checker above. It shows the record, explains each term and counts the DNS lookups. From a terminal, run dig txt example.com +short and look for the line that starts with v=spf1.
What is the SPF 10-lookup limit?
A receiver may make at most 10 DNS lookups to evaluate an SPF record. The terms include, a, mx, ptr, exists and redirect each cost one, and an include also costs the lookups inside it. Past 10, SPF returns an error.
Can a domain have two SPF records?
No. A domain must publish exactly one SPF record. With two, receivers return a permanent error and SPF fails. Merge the terms of both into a single record.
What is the difference between -all and ~all?
-all tells receivers to fail mail from servers that are not listed. ~all is a soft fail: the mail is usually accepted and treated as suspicious. With a DMARC record in place, the practical difference is small.
Does SPF stop email spoofing by itself?
No. SPF checks the bounce address, which readers never see, not the From address they do see. DMARC closes that gap by requiring SPF or DKIM to match the From domain.