SPF checker: is your SPF record doing its job?
Check a domain's SPF record, count the DNS lookups it needs (including nested includes) against the limit of 10, and see what to fix in plain English.
Free, no signup. DNS lookups only: nothing is sent to the domain's mail server.
Common SPF problems and fixes
- No record: publish one TXT record starting with
v=spf1, listing your mail provider and every service that sends as you, ending in~allor-all. - Too many lookups: remove includes for services you no longer use, or replace some with the IP ranges they publish.
- Two records: combine every mechanism into one record; keep a single
allat the end. - A sender missing: if a tool sends from your domain (newsletters, invoices, support desk), its include must be in the record, or its mail fails SPF.
Need a new record? The SPF record generator builds one from the services you use. Example of a healthy record for Google Workspace plus one marketing tool:
v=spf1 include:_spf.google.com include:servers.mcsv.net ~all
SPF checker FAQ
What is SPF?
Sender Policy Framework: a TXT record that lists the servers allowed to send email for your domain. Receivers check it to spot forged senders.
What is the 10 lookup limit?
Evaluating SPF may trigger at most 10 DNS lookups (include, a, mx, ptr, exists and redirect each count, including those inside included records). Past 10, receivers stop and treat SPF as failed.
Should I use -all or ~all?
Both tell receivers that unlisted servers are not authorised. -all (fail) is strict; ~all (softfail) is gentler and common while you roll out DMARC. Never use +all, which authorises everyone.
Can a domain have two SPF records?
No. Two or more is a permanent error, and receivers ignore SPF for the domain. Merge them into one record.
Does passing SPF mean my email reaches the inbox?
No. SPF is one signal. DKIM, DMARC, your sending reputation and the quality of your list matter too; sending to addresses that bounce damages reputation fastest.
More free tools
- MX lookup
See a domain's mail servers and which provider runs them.
- DMARC checker
Read the DMARC policy, reporting address and what to tighten.
- DKIM checker
Find a domain's DKIM keys and check their length and status.
- BIMI checker
See whether inboxes can show your logo, and what is missing.
- Disposable email checker
Find out if a domain is a throwaway inbox service.
- SPF record generator
Build a correct SPF record for the services that send your email.
- DMARC record generator
Create a DMARC record, from monitoring to full protection.
- Free email verifier
Check whether one address actually exists, with a live mailbox check.
A healthy domain is half of it. Verify the addresses too.
Free credits on sign-up. No card. You only pay for definite answers.
Start free