SPF record checker

Read a domain’s SPF record, spot common mistakes and see how close it is to the 10-lookup limit.

What is an SPF record?

Sender Policy Framework (SPF) is a DNS TXT record that lists which servers may send email using your domain in the envelope sender address. A receiving server looks up the record, compares the connecting IP address with it and decides whether the message passes, fails or lands somewhere in between. The record always starts with v=spf1, followed by mechanisms such as ip4:, include:, a and mx, and usually ends with an all term.

What this checker looks for

• Exactly one record. A domain must publish a single SPF record. If two are published, receivers may treat the result as a permanent error, so SPF stops protecting you. The checker lists every record it finds.
• The all qualifier. -all asks receivers to reject unlisted senders, ~all marks them as softfail, ?all expresses no opinion, and +all authorises everyone, which defeats the purpose of SPF.
• DNS lookups against the limit of 10. The specification caps the DNS-querying terms evaluated for one check: include, a, mx, ptr, exists and redirect. Terms inside included records count too, so a few marketing and support platforms can use the budget quickly. Terms such as ip4, ip6 and all cost nothing.

How the lookup count works here

The tool counts the terms in your record and follows include and redirect targets through Google Public DNS, up to a safe depth and number of extra queries. If an included record cannot be read, that include is still counted once but nothing inside it is, so treat the number as a minimum in that case. The ptr, exists and macro terms are counted, not evaluated, and this tool does not simulate whether a particular IP address would pass.

Fixing common SPF problems

If you have two records, merge them into one by combining their mechanisms. If you are over the limit, remove services you no longer use, replace a and mx terms with explicit ip4 ranges where those addresses are stable, or ask the provider whether it offers a dedicated include. Avoid ptr; the specification discourages it. After any change, wait for DNS caches to expire and check again.

SPF is one piece of authentication

SPF checks the envelope sender, not the visible From address, and it can break when mail is forwarded. That is why it is paired with DKIM signatures and a DMARC policy that ties them to the From domain. Check them with the DKIM checker and the DMARC checker, and read the sending setup guide before you start outreach. Passing SPF does not mean a particular mailbox exists. For that, use the free email verifier.