SPF Checker
Check any domain's SPF record, see every mechanism explained, and catch the too-many-lookups and weak-policy issues that break email authentication.
What is SPF?
SPF (Sender Policy Framework) helps prevent unauthorized hosts from sending emails on behalf of your domain. It specifies which servers can send email using your domain.
- ip4/ip6 — Permitted senders (IPv4/IPv6)
- include — Include trusted provider records
- all — What to do if no match (-all: reject; ~all: softfail)
SPF Best Practices
- Use -all for strong enforcement; ~all is less secure.
- Avoid exceeding 10 DNS lookups in SPF records.
- Check for recursion/loops in includes.
- Review provider IP ranges regularly.
Common SPF Misconfiguration Issues
- SPF missing -all or ends with ~all.
- Too many DNS lookups (>10).
- Non-existent or invalid include domains.
Frequently Asked Questions
What does this SPF checker do?
It fetches your domain's SPF TXT record, resolves every include and redirect, and counts the DNS lookups against the RFC limit of 10 so you can spot records that will fail.
Why does the 10-lookup limit matter?
SPF allows at most 10 DNS-querying mechanisms. Exceed it and many receivers return a PermError and ignore your SPF entirely, hurting deliverability. Flatten or remove unused includes to stay under it.
Should I end my record with -all or ~all?
-all (hardfail) is the strongest. ~all (softfail) is a safer starting point while testing. Avoid ?all and +all, which provide almost no protection.
Is it free and private?
Yes. Lookups run in your browser via public DNS-over-HTTPS and nothing is stored.
Pair SPF with DMARC for full protection · Built for admins & security pros.