Free tool
SPF record checker
Look up a domain's SPF record and see whether receivers will accept it - duplicates, lookup limits and risky all mechanisms, explained in plain English.
In short
An SPF record is a TXT record at your domain, starting with v=spf1, that lists the servers allowed to send mail as that domain. A domain must publish exactly one, it must resolve in no more than 10 DNS lookups, and it should end in ~all or -all.v=spf1 include:_spf.google.com include:mailgun.org ~all
What makes an SPF record valid
One record only. Two TXT records that both start with v=spf1 are a permanent error, and receivers treat the domain as having no valid SPF at all. When you add a new sending service, merge its include into the existing record instead of publishing a second one.
Ten DNS lookups at most. Every include, a, mx, ptr, exists and redirect costs a lookup, and includes nest - an include of a provider that itself includes three more counts all four. Past ten, evaluation fails with a permerror. Remove services you no longer use, and replace an include with ip4 or ip6 ranges only where the provider publishes them as stable.
A sensible ending. ~all (soft fail) and -all (fail) both tell receivers that unlisted servers are not allowed. +all allows anyone on the internet to pass SPF as your domain and should never be published; ?all says nothing at all.
SPF alone does not stop spoofing
SPF checks the envelope sender (the Return-Path), which the recipient never sees - not the From address in their inbox. That is why DMARC exists: it passes only when SPF or DKIM passes for a domain aligned with the visible From. Check your DMARC record next, and sign mail with DKIM so a message forwarded through another server still authenticates.
How the three authentication records work together is explained in SPF, DKIM and DMARC explained.
Questions
How do I check my SPF record?
Enter your domain above. The checker reads the TXT records at the domain, finds the record starting with v=spf1, and flags duplicates, a missing or permissive all mechanism, and top-level lookups approaching the limit of 10 - nested includes add more, so treat a warning as a prompt to count them.
Can a domain have two SPF records?
No. Two records starting with v=spf1 make SPF evaluation fail with a permanent error. Combine every sending service into one record with one include each.
Should SPF end in ~all or -all?
Either is fine once every service that sends as your domain is listed. Many domains publish ~all and rely on DMARC to set the enforcement policy, since DMARC is what receivers act on for the visible From address.
What is the SPF 10 lookup limit?
RFC 7208 caps SPF evaluation at 10 DNS-querying mechanisms - include, a, mx, ptr, exists and redirect - counted across nested includes. A record that needs more fails with a permerror, so receivers treat it as invalid.
More free email tools
DMARC checker
Check any domain's DMARC record and reporting address. See what p=none, quarantine and reject mean, and what to change next. Free, no sign-up.
DKIM checker
Look up a DKIM record by domain and selector. Checks the public key is published, readable and not revoked, and shows how to find your selector. Free.
MX record lookup
Look up any domain's MX records to see which servers receive its mail and in what order, alongside its SPF and DMARC. Free, no sign-up.
Email address checker
Check whether an address can receive mail before you send to it.
Send your first email in minutes
6,000 emails a month (up to 200 a day), free forever. No card needed.