SPF record checker
Enter your domain and we'll parse your SPF record and follow the include chain. We also count the 10 DNS lookup limit — the most common and most silent failure: once it's exceeded, your SPF record stops working entirely.
No signup, no email required. Only public DNS records are read.
How to read an SPF record
An SPF record starts with 'v=spf1' and is a space-separated list of mechanisms. Each mechanism authorises a sender; the trailing 'all' states what to do with everyone who isn't listed.
| Mechanism | Meaning |
|---|---|
| ip4: / ip6: | The given IP address or block may send. Costs no DNS lookup. |
| include: | Also accept another domain's SPF record. Each include costs 1 DNS lookup. |
| a / mx | Hosts in the domain's A or MX records may send. Each costs 1 lookup. |
| exists: | Allow if the given lookup returns a result. Rarely needed, costs 1 lookup. |
| ptr | Checks reverse DNS. The standard advises against using it. |
| -all | Reject everyone not listed (hardfail). |
| ~all | Mark everyone not listed as suspicious (softfail). |
| ?all | Neutral — effectively says nothing. |
| +all | Allow everyone. Almost always a mistake. |
What is an SPF record?
SPF (Sender Policy Framework) is a DNS TXT record where you declare which servers may send email on behalf of your domain. When a receiving server gets mail that appears to come from you, it checks whether the sending IP is on that list.
The goal is to make forgery harder and to keep your genuine mail out of the spam folder. Large providers such as Gmail and Outlook are noticeably more suspicious of domains without SPF, and for bulk senders it is now effectively mandatory.
The most common mistake: the 10 DNS lookup limit
SPF allows a maximum of 10 DNS lookups while a record is evaluated. The include, a, mx, exists and ptr mechanisms each consume from that budget — and the includes inside an included record count against the same budget.
What happens when you exceed it is insidious: the record still sits in DNS and looks perfectly fine, but the receiving server ends evaluation with 'permerror' and behaves as though you had no SPF at all. For a large share of companies wondering why their mail lands in spam, this is exactly the cause.
How it builds up: Google Workspace plus a CRM plus a billing service plus a marketing tool plus an old hosting provider — each adds an include, nobody removes the old ones, and one day the limit is quietly crossed. The tool above walks the chain and shows your real lookup count.
Should I use ~all or -all?
'-all' (hardfail) is stronger: mail from unlisted servers is rejected. But if you forgot to list a service that sends on your behalf, its mail is rejected too — invoices, payroll or appointment reminders can disappear silently.
So the practical path is: start with '~all' (softfail), watch DMARC reports for a few weeks to discover every service sending as you, add them all to the record, then switch to '-all'.
'?all' and '+all' should never be used in production: the first says nothing, the second authorises everyone.
SPF by provider
If you use Google Workspace, your record should contain 'include:_spf.google.com'. For Microsoft 365 expect 'include:spf.protection.outlook.com', and for Yandex 'include:_spf.yandex.net'.
If you send through a hosting company's shared mail server, their include or IP address must be present. Using several providers at once is fine — each is added as its own mechanism — but remember how quickly that drains the lookup budget.
Run your domain through the tool above to see which providers are in your chain and which ones no longer respond.
SPF alone is not enough
SPF only validates the sending server's IP. It doesn't guarantee the message wasn't altered in transit, and it usually breaks when mail is forwarded.
That's why SPF, DKIM and DMARC belong together. DKIM signs the message cryptographically, and DMARC ties the SPF and DKIM results to a policy: you decide what happens to mail that fails, and you get reports. Without all three, your domain isn't meaningfully protected against spoofing.
Frequently asked questions
How do I check an SPF record?
Enter your domain in the tool on this page; it reads your SPF record, follows the include chain and counts the DNS lookups. You can also see the raw record from a terminal with 'dig +short TXT yourdomain.com'.
I have an SPF record but my mail still lands in spam — why?
The most common cause is exceeding the 10 DNS lookup limit, which makes a valid-looking record stop working entirely. Other frequent causes are multiple SPF records, a missing DKIM signature, and no DMARC record at all.
How many SPF records can a domain have?
Exactly one. Publishing more than one is a standards violation and your domain is evaluated as if it had no SPF. When adding a new service, edit the existing record rather than creating a second one.
What is the 10 lookup limit in SPF?
SPF permits at most 10 DNS lookups while evaluating a record. The include, a, mx, exists and ptr mechanisms all draw from that budget. Exceeding it results in 'permerror' and the record is treated as invalid.
How long does an SPF change take to apply?
As long as the record's TTL. With most DNS providers that's between 300 and 3600 seconds, so changes usually propagate within 5 minutes to an hour.
Is this tool free? Do I need an account?
It's completely free and requires no account or email address. It only reads public DNS records and needs no authorisation over the domain you look up.