Skip to content
StoutNook
Menu
Every tool runs in your browser. Your files never leave your device.

SPF checker

Enter a domain to find its SPF record, check it for errors, count the DNS lookups it uses against the limit of 10, and see which mail servers are allowed to send email for it.

Public DNS lookup. Only the domain and record names (such as example.com) are sent, to Cloudflare's DNS resolver.

You'll see the SPF record, every term explained, the include tree with its DNS lookup count, who may send as the domain, and any problems with fixes.

  • Looks up public DNS records only
  • Free, no sign-up
  • Works on phone and desktop

How to check an SPF record

  1. 1

    Type your domain, such as example.com. A web address or an email address works too.

  2. 2

    Click Check SPF. The record is looked up, and every include is followed and counted.

  3. 3

    Read the verdict and the lookup count: more than 10 lookups breaks SPF for all your mail.

  4. 4

    Work through the fixes, update the TXT record at your DNS host, and check again.

Features

  • Every lookup counted

    Includes are followed to the bottom and each DNS lookup is counted against the limit of 10, along with void lookups.

  • Include tree

    See each included record, what it costs and which service it belongs to: Google, Microsoft 365, SendGrid, Mailchimp and more.

  • Plain-English terms

    Each part of the record is explained, with syntax errors, typos and risky settings such as +all flagged.

  • Public DNS only

    Only DNS names are looked up, through Cloudflare. No sign-up, nothing stored, no emails sent.

What an SPF record does

Sender Policy Framework (SPF, RFC 7208) lets a domain publish the list of servers that may send its email. When a message arrives, the receiving server takes the domain from the envelope sender, the hidden "Return-Path" address used for bounces, looks up that domain's SPF record and checks whether the sending server's IP address is on the list. The result is pass, fail, soft fail or neutral.

SPF does not check the From: address people see in their inbox. That gap is why SPF works best together with DKIM and DMARC, covered below.

How to read an SPF record

A typical record for a company that uses Google Workspace and a newsletter service, plus one office server, looks like this:

v=spf1 ip4:192.0.2.25 include:_spf.google.com include:servers.mcsv.net ~all

Receivers read it from left to right and stop at the first term that matches the sending server. v=spf1 marks the record. ip4:192.0.2.25 allows one address. Each include: pulls in the list another domain publishes, here Google's and Mailchimp's. ~all says what happens to every other server: soft fail.

TermMeansDNS lookup?
ip4: / ip6:An address or rangeNo
a / mxThe domain's own addresses, or its mail serversYes
include:Another domain's SPF listYes, plus its own
redirect=Use another domain's record insteadYes
exists: / ptrRare; ptr is deprecatedYes
-all ~all ?all +allFail, soft fail, neutral or pass everything elseNo

The 10-lookup limit

To keep SPF checks from overloading DNS, RFC 7208 stops evaluation after 10 terms that need a DNS query, counted through every nested include. Past that, the result is a permanent error and SPF fails for all your mail, including the legitimate kind. The standard also allows only two "void" lookups (names that don't exist or have no records), and at most 10 mail servers behind any one mx term.

The limit sneaks up on growing businesses. Microsoft 365, a help desk, a CRM and two marketing tools can each cost one to three lookups. This checker shows the running total and the cost of every branch in the include tree, so you can see what to trim.

Common SPF mistakes and how to fix them

This record for a fictional shop has three problems:

v=spf1 inlcude:_spf.google.com include:spf.protection.outlook.com +all
v=spf1 include:sendgrid.net ~all
  • Two SPF records. Only one is allowed; with two, receivers ignore SPF altogether.
  • A typo. "inlcude" isn't a mechanism, which makes the whole record invalid.
  • +all lets every server on the internet pass, which is worse than having no record.

Merged and fixed, it becomes:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:sendgrid.net ~all

Other frequent problems: forgetting the all at the end, includes left over from services you no longer use, using the old "SPF" DNS record type (RFC 7208 allows only TXT), and long records split into strings without a space at the join. DNS joins the strings with nothing in between, so "...include:a.example" followed by "include:b.example ~all" becomes one broken term.

How SPF, DKIM and DMARC fit together

SPF breaks when mail is forwarded, because the forwarding server isn't on your list, and it says nothing about the visible From: address. DKIM adds a signature that survives forwarding. DMARC then ties both to the From: domain: a message passes DMARC when SPF or DKIM passes for a domain that aligns with From:, and your DMARC policy tells receivers what to do when neither does.

Since February 2024, Gmail and Yahoo have required SPF or DKIM from every sender, and SPF, DKIM and DMARC from bulk senders. To see where your domain receives mail, run an MX lookup.

Frequently asked questions

What is an SPF record?

A TXT record in your domain's DNS that lists the servers allowed to send email for the domain. Receiving mail servers compare the sending server's IP address with the list. It is defined in RFC 7208 and always starts with v=spf1.

Can a domain have more than one SPF record?

No. If a domain has two TXT records starting with v=spf1, receivers return a permanent error and ignore SPF entirely. Merge them into one record with a single v=spf1 at the start and a single all at the end.

What does "too many DNS lookups" mean?

Receivers stop after 10 DNS lookups while checking SPF. Each include, a, mx, ptr, exists and redirect counts, including those inside the records you include. Over 10, SPF fails with a permanent error (permerror) for all your mail, so remove unused includes or move some senders to a subdomain.

Should my SPF record end in ~all or -all?

Either is fine once you have DMARC. -all (fail) is stricter; ~all (soft fail) asks receivers to accept but distrust the mail. Because some receivers reject -all failures before DMARC runs, which can drop forwarded mail, many administrators use ~all and let a DMARC policy decide. Never use +all or ?all.

Why does SPF pass but DMARC fail?

SPF checks the envelope sender (Return-Path) domain, which email services often set to their own domain. DMARC also needs that domain to match the From: address you see. If it doesn't, rely on DKIM signed with your own domain, or set up a custom return path with your email service.

Do I need SPF if my domain doesn't send email?

Yes. Publish "v=spf1 -all" so anyone faking mail from the domain fails SPF, and add a DMARC record with p=reject. Parked and website-only domains are popular with spammers precisely because they often have no records.

How long until an SPF change takes effect?

As soon as DNS caches expire, which depends on the record's TTL: often 5 minutes to an hour, rarely up to a day. This checker asks Cloudflare's public resolver, which may briefly show the old record too.

More free tools