SPF record checker
Type a domain to read its SPF record, count its DNS lookups and see what to change when something is wrong. Free, no account.
Every record is checked in the same pass. Also: DKIM checker, DMARC checker, MX record lookup. Full domain check.
What a correct SPF record looks like
SPF is one TXT record at the root of the domain. It starts with v=spf1, names every service that sends mail as you, and ends by saying what to do with everything else.
The ending matters. ~all asks receivers to treat other senders as suspicious, -all asks them to refuse. +all lets anyone on the internet send as you and should never be published.
yourdomain.com. TXT "v=spf1 include:_spf.google.com include:spf.smailor.com ~all"
The mistakes the checker finds most
Two SPF records on the same domain. Receivers do not merge them: they return a permanent error and SPF fails for every message. Join the includes into one record.
More than 10 DNS lookups. Each include, a, mx, ptr, exists and redirect counts, including the ones inside the records you include. Past ten, SPF fails. Remove services you no longer send from before anything else.
A record that ends in ?all or has no ending at all. It authorizes nothing, so it protects nothing.
Where SPF stops
SPF checks the envelope sender, the address a forwarded or bounced message returns to, not the From line your recipient reads. That is why DMARC exists: it requires SPF or DKIM to pass for the domain in the From line. A domain with SPF and no DMARC is only half protected.
Questions
How many SPF records can a domain have?
One. RFC 7208 requires a single TXT record starting with v=spf1 per domain name. With two, receivers return a permanent error and SPF fails for all your mail. Merge the mechanisms of both into one record.
What is the SPF 10 lookup limit?
SPF evaluation may trigger at most 10 DNS lookups, counting include, a, mx, ptr, exists and redirect, recursively through every included record. Above ten the result is permerror and SPF fails. The checker counts them for you and lists every service the record authorizes.
Should my SPF record end in ~all or -all?
Both are valid. ~all (softfail) is the common choice while you are still finding every service that sends as you. -all (fail) is stricter. Once DMARC is enforced, receivers act on the DMARC policy anyway, so ~all is enough for most domains.
Does SPF stop people from spoofing my From address?
Not alone. SPF checks the envelope sender, which is often a different domain from the From line the recipient sees. DMARC links the two: it passes only if SPF or DKIM pass for the domain in the From line, and tells receivers what to do when neither does.
Reads public DNS only. A DKIM key we cannot find is reported as not determined, never as an error. Results are kept for ten minutes.