Free tool · No sign-up

SPF record checker

Updated 2 November 2026

Enter your domain to look up its SPF record in public DNS, count the DNS lookups it triggers against the limit of 10, and catch the mistakes that make receivers ignore it: two SPF records, a missing or permissive all, and deprecated mechanisms.

What SPF is

Sender Policy Framework is a TXT record on your domain that lists the servers allowed to send email for it, for example v=spf1 include:_spf.google.com include:sendgrid.net ~all. Receiving mail servers compare the sending server against that list. On its own SPF checks the hidden envelope sender, not the From: address people see, so it works together with DKIM and DMARC to stop spoofing.

What this checker tests

Exactly one record. Two TXT records starting with v=spf1 is a permanent error (permerror), and receivers treat SPF as failing. It often happens when a new email service tells you to "add this record" and you add a second one instead of merging.
The all mechanism. -all (fail) or ~all (soft fail) at the end tells receivers what to do with servers not on the list. +all lets anyone send as you, and ?all gives no protection.
The 10-lookup limit. Each include, a, mx, exists, ptr and redirect costs a DNS lookup, including the ones nested inside included records. More than 10 is a permerror. The checker follows includes and adds them up.
Deprecated ptr. Slow, unreliable and discouraged by the SPF standard.

Fixing common problems

Merge duplicate records into one: keep one v=spf1, list every include once, and end with one all. If you're over 10 lookups, remove services you no longer use first. Some providers offer a single include that covers several of their systems. "Flattening", replacing includes with the IP addresses they resolve to, works but breaks silently when the provider changes IPs, so re-check it regularly.

If a domain never sends email, publish v=spf1 -all and a DMARC record with p=reject. Parked domains are popular for spoofing precisely because nobody protects them.

Frequently asked questions

Should I use -all or ~all?

~all is the safer start while you confirm every sender is listed. Once DMARC reports show all legitimate mail passing, -all is fine. With DMARC at p=reject, the difference matters less.

Why does my SPF say too many DNS lookups?

Each include and the includes inside it count toward a limit of 10. Remove unused services, use the provider's combined include, or flatten carefully.

Can I have two SPF records if I use two email services?

No. Combine them into one record with both includes, for example v=spf1 include:_spf.google.com include:servers.mcsv.net ~all.

Does SPF stop people faking my From: address?

Not by itself. SPF checks the envelope sender. DMARC ties SPF and DKIM to the visible From: domain and tells receivers to reject fakes.