DomainDNSCheck

SPF Record Checker

Enter a domain to find its SPF record and check it for the mistakes that most often cause legitimate email to fail authentication.

  • Email security
  • Live check
  • Free, no sign-up
  • Results are not published

For example example.com — URLs and email addresses are accepted too.

At a glance

What it checks
Validate a domain's SPF record, its all qualifier and the number of DNS lookups it needs against the limit of 10.
Data source
TXT records of the domain and of every include and redirect, counted the way receivers count them.
Freshness
Live check; results are cached for up to 10 minutes
Limits
Macros are not expanded, and recursion stops at safety limits (depth 10, 40 queries); the count is then marked incomplete. Methodology
Cost
Free, no account needed

Understanding the result

What SPF does

Sender Policy Framework (SPF) is a TXT record that lists the servers allowed to send email using your domain in the envelope sender address. Receiving servers compare the connecting IP address with that list. A typical record looks like this:

v=spf1 ip4:198.51.100.0/24 include:_spf.example.net -all

Here, one address range and the servers of an email provider are authorized, and everything else should fail. For a fuller explanation, read What SPF does.

What the checker evaluates

  • Record present: a missing SPF record is a FAIL when the domain has MX records, and a WARNING when it does not receive mail.
  • Multiple records: publishing more than one v=spf1 record is a FAIL, because receivers treat it as a permanent error and ignore SPF entirely.
  • Syntax: unrecognized mechanisms or modifiers are flagged as a WARNING.
  • The all mechanism: -all (fail) and ~all (softfail) pass. ?all (neutral) is a WARNING because it asserts nothing. +all is a FAIL because it authorizes every server on the internet. A record with no all and no redirect is a WARNING.
  • ptr mechanism: a WARNING, since it is slow, unreliable and discouraged by the standard.
  • DNS lookup count: see below.
  • Length: very long records are noted, since they may need to be split across strings or cause issues with some DNS software.

The 10-lookup limit

SPF limits evaluation to 10 DNS-querying terms. The mechanisms include, a, mx, ptr and exists, plus the redirect modifier, each count, and so do the terms inside every included record. ip4, ip6 and all are free. When the limit is exceeded, receivers return a permanent error and SPF fails for all your mail.

The checker walks the include and redirect tree and counts the terms. Up to 7 lookups is a PASS, 8 to 10 is a WARNING, and more than 10 is a FAIL. If the tree is too large to follow or a lookup fails, the count is marked UNKNOWN. Includes that use SPF macros (containing %) cannot be expanded without a real message and are counted but not followed.

To reduce the count, remove includes for services you no longer use, replace a and mx with ip4 or ip6 ranges where addresses are stable, and ask providers whether they offer a narrower include.

SPF alone is not enough

SPF checks the envelope sender, not the From address people see, and it breaks when mail is forwarded. It works best alongside DKIM signatures and a DMARC policy. Check them with the DKIM Checker and DMARC Checker, or review everything with the Email Security Checker.

Frequently asked questions

Should I use ~all or -all?

Both are acceptable. With DMARC in place, receivers base their decision on the DMARC policy, so ~all is common and slightly more forgiving during changes. Use -all once you are confident every sending service is listed.

How do I combine two SPF records?

Merge them into one record with a single v=spf1 at the start and a single all at the end, keeping every include, ip4 and ip6 term from both. Then delete the second record.

Does SPF flattening help?

Replacing includes with the IP addresses they currently resolve to reduces the lookup count, but those addresses change without notice. If you flatten, use a service or process that keeps the list updated.

Do subdomains inherit my SPF record?

No. Each hostname used in an envelope sender needs its own SPF record. DMARC, by contrast, can apply to subdomains through the organizational domain.