SPF checker
SPF is a DNS record that lists the servers allowed to send mail for your domain. This reads yours, counts the DNS lookups it causes through every include and redirect, and checks for the usual faults: more than one record, an unsafe ending, or more than 10 lookups.
One record, under the 10-lookup limit counted through every include, with a safe ending.
What this checks, and how.
- We fetch the TXT records for the domain and pick out those that start with v=spf1.
- We follow each include: and redirect= to count the lookups a receiving server would make. SPF allows 10; above that, receivers treat the record as broken.
- We read the ending (-all, ~all, ?all) and any address terms that are not valid, then list findings with the record shown as published.
What an SPF record does.
SPF stands for Sender Policy Framework. It is a single line of text in your domain's DNS that lists the servers allowed to send mail using your domain in the envelope sender (the hidden Return-Path or MAIL FROM address that mail servers use to talk to each other). When a message arrives, the receiving server looks up that domain's SPF record, compares the connecting server's IP address with the list, and records a result: pass, fail, softfail, neutral, none, temperror or permerror.
Two things follow from that. First, SPF checks the envelope sender, not the From address a person sees. A message can pass SPF and still show a From address on another domain, which is why DMARC adds an alignment check on top. Second, SPF is only a list. It says which servers are welcome. What the receiver does with a failure depends on its own policy and on your DMARC record, so SPF alone does not stop someone spoofing your domain.
A typical record looks like this. The v=spf1 tag marks it as SPF, each include: pulls in the list of a sending service, ip4: allows one address or range, and the last term says what to do with everything else.
v=spf1 ip4:203.0.113.10 include:_spf.mail-provider.example ~all
Every domain that appears in a message's envelope sender needs its own record. If a service sends on your behalf from a subdomain, that subdomain needs SPF too.
How to read what the checker shows.
The checker shows the record exactly as published, the number of DNS lookups it causes when followed through every include and redirect, its ending, and a list of findings. Work through them in this order.
1. Is there exactly one record?
A domain should publish one SPF record. If you find two TXT records that start with v=spf1, receivers can return a permanent error instead of a result, and your mail then has no working SPF at all. Merge the two into one record by combining their terms, keeping a single v=spf1 at the start and a single ending term.
2. How many lookups does it cause?
SPF allows ten. RFC 7208 section 4.6.4 says implementations must limit the terms that cause DNS queries to 10 during evaluation, and a record that goes over produces a permanent error (permerror). The terms that count are include, a, mx, ptr, exists and the redirect modifier. The terms ip4, ip6 and all do not count. Lookups inside the records you include count too, which is why a record with only four includes can still be over the limit. The same section also says implementations should limit "void lookups" (queries that return nothing) to two.
3. What is the ending?
| Ending | Meaning | When people use it |
|---|---|---|
-all | Fail: the sender is not authorised | A domain whose senders are all known and listed |
~all | Softfail: probably not authorised, treat with suspicion | While adding senders, or when DMARC does the enforcing |
?all | Neutral: no statement either way | Rarely useful; it gives receivers nothing to act on |
+all | Pass: every server is authorised | Never. It allows anyone on the internet to send as you |
Many teams run ~all with a DMARC policy and accept its softfail, while others publish -all once they are sure every sender is listed. Which one you choose is a judgement about how complete your sender list is. The checker flags ?all and +all because neither protects the domain.
The usual faults, and the fix for each.
| Finding | Usual cause | Fix |
|---|---|---|
| More than one SPF record | A new service told you to add a record, and someone added a second TXT line | Merge into one v=spf1 record. Keep every include: and ip4: term from both |
| More than 10 lookups | Many sending tools included on one domain | Remove services you no longer use, move some senders to a subdomain, or replace an include with ip4: terms where the provider's addresses are stable |
| No SPF record found | The record was published on the wrong host, or has not propagated | Publish it as a TXT record at the root of the domain (host @), then check again after the TTL |
Unsafe ending (?all or +all) | A copied example, or a record left open while testing | Change to ~all or -all |
| Invalid term | A typo such as include with no colon, or an address that is not valid | Correct the term. A record with a syntax error can fail as a whole |
| Record over 255 characters (the checker does not flag this) | A TXT string over 255 characters that was not split into quoted pieces | A single DNS string holds 255 characters, so a long value must be stored as several quoted strings in one record. Most DNS hosts do this for you; check that yours shows the record as one value |
Getting under the 10-lookup limit
Start by listing every service that sends as your domain and delete the ones you have stopped using. Old newsletter tools and trial accounts are the usual leftovers. Next, move a sender with its own volume to a subdomain: marketing mail from mail.yourdomain.com has its own record and its own count of ten. Last, you can replace an include with the provider's IP ranges, but only if the provider publishes stable ranges, because the record then needs updating whenever they change. Services that rewrite your record automatically (often called SPF flattening) carry the same upkeep risk, so check how they handle changes before you rely on one.
SPF, DKIM and DMARC work as a set.
SPF breaks when a message is forwarded, because the forwarding server's address is not on your list. DKIM signs the message itself, so it survives most forwarding. DMARC then asks whether SPF or DKIM passed and aligned with the domain in the From address. A domain that relies on SPF alone has no second chance if SPF fails, which is why all three are worth setting up, and why the DKIM checker and DMARC checker sit next to this one.
Mailbox providers now ask for this. Google's sender guidelines, read on 24 October 2026, require SPF or DKIM from all senders, and SPF, DKIM and DMARC from anyone sending more than 5,000 messages a day to personal Gmail accounts, with the DMARC policy allowed to be none. They also say to keep the spam rate reported in Postmaster Tools below 0.3%. Authentication does not make a cold email welcome. It removes one reason for a receiver to distrust it.
A short checklist before you send from a new domain
- Publish one SPF record that lists only the services you send with.
- Run this checker and confirm one record, under 10 lookups, with
~allor-all. - Publish DKIM for each sending service and confirm it with the DKIM checker.
- Publish a DMARC record at
p=nonewith a reporting address, then read the reports before tightening it. - Warm the mailbox before you send volume. The warmup calculator plans the ramp, and the deliverability checker runs SPF, DKIM, DMARC and MX in one pass.
Quick answers.
Why is more than one SPF record a problem?
A domain should publish a single SPF record. With two, receivers can return an error instead of a result. Merge them into one.
What does the 10-lookup limit count?
Each include:, a, mx, ptr, exists: and redirect= costs a DNS lookup, and lookups inside included records count too. The checker counts through every include for you.
Can I build a record from scratch?
Yes. The SPF record generator builds one from the senders you use and counts its lookups.
Should I use ~all or -all in my SPF record?
Both are valid. -all tells receivers to reject mail from servers you have not listed, and ~all asks them to treat it as suspicious. Use -all once you are sure every service that sends as your domain is listed. Use ~all while you are still finding senders, or when your DMARC policy does the enforcing. Avoid ?all and +all: neither protects the domain.
How long does an SPF change take to work?
Receivers read your record from DNS, so a change is seen once the old value's time to live (TTL) has expired. Many records use a TTL between a few minutes and a few hours, so check again after that. The checker reads live DNS, so it shows what a receiver would see at that moment.
What is an SPF permerror?
A permanent error: the receiver could not evaluate your record at all. The usual causes are two SPF records on one domain, more than 10 DNS lookups, or a syntax error. Mail that gets a permerror has no SPF pass, so fix it before you send volume.
Does SPF stop people spoofing my domain?
Not on its own. SPF checks the envelope sender, not the From address a reader sees, and it only lists allowed servers. DMARC adds the alignment check and tells receivers what to do with failures, so SPF, DKIM and DMARC together are what protect a domain.
Fixed the records? Now warm the mailbox.
Free plan: one mailbox, capped sends. Every signup gets a free sandbox mailbox that's already warming.
- Free plan, no time limit
- 7-day trial on paid plans
- 30-day inbox guarantee, with conditions
- Customer data is hosted in the EU