Trust beats tactics™

SPF

SPF Record Checker

Enter a domain. We pull its SPF record from DNS, count lookups against the 10-lookup limit, name the services authorised to send, and flag the common ways an SPF record breaks.

New to SPF? Read What is SPF in the Email Almanac.

We resolve the TXT record for the domain server-side and walk every include to count lookups.

How this tool works

What the checker is actually doing

  1. 1

    It finds your record

    An SPF record is a single TXT record on your root domain that starts with v=spf1. It is a list of who is allowed to send mail using your domain. Lookups run on our server, so the result does not depend on your laptop's resolver or a captive portal.

  2. 2

    It counts your lookups

    It walks every include:, a, mx and redirect= mechanism to count the DNS lookups your record triggers. RFC 7208 caps that at 10. Above 10 returns permerror, and most receivers treat permerror as a failure regardless of the sending IP.

  3. 3

    It flags what breaks

    It checks the qualifier on all at the end, names every well-known sender it can identify from the includes, and flags duplicate records when there is more than one v=spf1 TXT on the domain.

A record, read the way the checker reads it

v=spf1 include:_spf.google.com ~all

DNS lookups: 1 of 10

Past 10 the record returns permerror, and the check fails.

When to use it

Reach for it in these moments

  • A campaign suddenly bounces

    With an SPF permerror or temperror, it tells you which mechanism pushed you over the lookup limit, so you know what to flatten or remove.

  • You added a sending service

    A CRM, a support desk, a transactional ESP. It confirms the service's include is actually in your record and not shadowed by another mechanism.

  • You are auditing a vendor or a new domain

    A loose +all or a missing record on a brand asset is a fast signal that spoofing risk is wide open.

  • Before you write a DMARC policy

    DMARC alignment only works when SPF is publishing a clean answer in the first place.

Email Almanac

  • Not sure what this means?

    Ask a real person. The Email SOS Hotline is free help with any email problem, no pitch. Cleaning a list does not fix a DNS record, so if this check found a problem, start here.

    Ask the Email SOS Hotline

  • Keep this result

    Send it to your inbox, to share with your team or compare after a fix.

    Run a check, then email it

  • Your setup is one half. Your list is the other.

    A record that passes proves the mail is yours. Mailbox providers also judge you on who you send to. Clean your first 1,000 addresses free.

    Clean your first 1,000 free