Olvane
Log inGet started

SPF record checker

Check that your SPF record is valid, stays under the 10 DNS lookup limit, and actually protects your domain.

Free, no sign-up. We only read public DNS records.

What SPF does

SPF (Sender Policy Framework) is a TXT record that lists the servers allowed to send email for your domain. When a message arrives, the receiving server compares the sending server's IP address with your list. If it isn't there, the message fails SPF.

A typical record for a business using two services looks like this:

v=spf1 include:_spf.google.com include:send.example-provider.com ~all

How the record is built

PartMeaning
v=spf1Marks the record as SPF. It must come first.
ip4: / ip6:Allows a single address or range. Costs no lookups.
include:Allows every server listed in another domain's SPF record. Costs one lookup plus everything inside it.
a / mxAllows the servers your domain's A or MX records point to. One lookup each.
~all / -allWhat happens to everyone else: softfail or fail. It goes last.

Staying under 10 lookups

The lookup limit is where most SPF records break. Large providers include several more records inside their own, so one include: can cost three or four lookups. To get back under the limit:

  • Remove services you no longer send from. Old newsletter tools and CRMs are the usual suspects.
  • Replace a and mx with the actual ip4: addresses if they rarely change.
  • Send marketing email from a subdomain such as news.yourdomain.com with its own SPF record.

Need to build a record from scratch? Use the SPF generator.

SPF is only one part

SPF breaks when mail is forwarded, because the forwarding server isn't on your list. That's why DKIM and DMARC exist: DKIM signatures survive forwarding, and DMARC passes if either one lines up with your domain. Check all three together with the email DNS checker.

Common questions

What is the SPF 10 lookup limit?

SPF allows at most 10 DNS lookups while a record is evaluated. Every include, a, mx, ptr, exists and redirect counts, including the ones inside the records you include. Go over 10 and SPF returns a permanent error, which receivers treat as a failure.

Can a domain have two SPF records?

No. A domain must publish exactly one TXT record starting with v=spf1. With two or more, SPF fails for every message. Combine all your providers into a single record.

Should I use ~all or -all?

Both tell receivers that servers not listed aren't allowed. -all (fail) is stricter, ~all (softfail) is more forgiving if you've forgotten a sender. With DMARC in place, either works, because DMARC decides the final outcome. Never use +all.

Why does the checker say my SPF is on a subdomain?

Many sending services use their own bounce address, such as send.yourdomain.com, and SPF is checked against that address rather than the domain in the From line. That's fine for delivery, but you should still publish an SPF record on the main domain so it can't be used freely by others.

More free email tools

Email DNS checker

MX, SPF, DKIM, DMARC, MTA-STS and BIMI in one report.

DKIM checker

Find a DKIM key by selector and check its length.

DMARC checker

Read your DMARC policy and reporting setup.

MX lookup

See which servers receive mail for a domain.

DMARC generator

Build a DMARC record step by step.

SPF generator

Build an SPF record for your email providers.

Want records that are right from the start?

The free plan needs no card. Most of the setup is copying five DNS records.

Create your account