Free SPF Record Lookup Tool — Check & Analyze SPF Records

Features · Advantages · Benefits

Why check your SPF record?

A misconfigured SPF record means legitimate emails go to spam — or worse, anyone can spoof your domain.

Feature

Full Mechanism Parsing

Breaks down every mechanism in your SPF record — include:, ip4:, mx:, a:, all — with what each one authorises.

Advantage

DNS Lookup Counter

SPF fails silently if you exceed 10 DNS lookups. We count yours and warn you before it becomes a delivery problem.

Benefit

Issues & Warnings

Catch dangerous settings like +all, missing catch-all, or deprecated ptr mechanisms before they cause damage.

include:

Imports another domain's SPF record. Used to authorise third-party senders like Google Workspace, Mailgun, or SendGrid.

ip4: / ip6:

Directly authorises an IP address or range. Doesn't cost a DNS lookup — preferred for known server IPs.

-all

Hard fail catch-all. Any server not listed above is rejected. The recommended ending for a strict SPF record.

~all

Soft fail. Unlisted servers are accepted but marked as suspicious. A common intermediate step before -all.

FAQ

Frequently asked questions

Everything you need to know about SPF records and email authentication.

SPF (Sender Policy Framework) is a DNS TXT record published at your domain that lists which mail servers are authorised to send email on your behalf. Receiving servers check this record and can reject mail from unlisted servers.

The SPF spec (RFC 7208) limits SPF evaluation to 10 DNS lookups. Each include:, a, mx, ptr, redirect, and exists counts toward this limit. ip4: and ip6: do not. Exceeding 10 causes a PermError — SPF fails for all your mail.

-all is a hard fail — receiving servers should reject emails from unlisted senders outright. ~all is a soft fail — unlisted senders are accepted but marked as suspicious (often goes to spam). Use -all for strict enforcement once you're confident all your senders are listed.

No — you must have exactly one SPF TXT record. Multiple SPF records cause a PermError. If you need to authorise multiple senders, combine them into a single record using multiple include: entries.

No. SPF only checks the envelope sender (Return-Path), not the visible From address. You also need DKIM for cryptographic signing, and DMARC to enforce policy and tie everything together. All three work as a system.

SPF Record Lookup