SPF Record Checker
?About this tool, how to use it, and FAQ▾
What is an SPF record checker?
SPF (Sender Policy Framework) is a DNS TXT record listing which servers are allowed to send email for your domain. This checker fetches a domain's SPF record, parses every mechanism (ip4, ip6, include, a, mx, and the all qualifier), and runs compliance checks against common failure modes.
It counts the DNS lookups your record triggers — SPF permits at most 10, and records that exceed the limit fail open at many receivers — and can optionally test a specific sender IP against the record to tell you whether that server would pass.
How to use
- Enter the domain whose SPF record you want to check.
- Optionally enter a sending server's IP address to test it against the record.
- Review the parsed mechanisms and their qualifiers (+ pass, - fail, ~ softfail, ? neutral).
- Fix anything the compliance checks flag — especially a DNS lookup count near or over 10.
Frequently asked questions
What is the SPF 10-DNS-lookup limit?
Evaluating an SPF record may trigger at most 10 DNS lookups (from include, a, mx, ptr, and exists mechanisms). Past that, receivers return permerror and your policy may be ignored entirely. Flattening includes or removing unused vendors brings the count down.
What is the difference between ~all and -all?
-all (fail) tells receivers to reject mail from servers not listed in the record; ~all (softfail) suggests accepting but marking it. -all is the stronger posture once you are sure every legitimate sender is listed.
Does a valid SPF record stop spoofing by itself?
No. SPF checks the envelope sender, which recipients never see, and it breaks on forwarding. You need DMARC on top of SPF (and ideally DKIM) to enforce alignment with the From address a human actually reads.