SPF Record Checker
Look up a domain's SPF record and see exactly who it lets send email.
Free, no signup — the answer appears right here.Try:
What an SPF record does
SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers allowed to send email on its behalf. When a receiving mail server gets a message claiming to be from your domain, it checks the connecting server against that list. No match, and the message is a candidate for the spam folder — or outright rejection.
An SPF record looks like v=spf1 include:_spf.google.com ~all. Every include, ip4, ip6, a and mx term widens the set of permitted senders, and the trailing ~all or -all says how strictly receivers should treat everyone else.
What this checker looks for
The report resolves your full SPF chain: the record itself, every nested include, the effective list of authorized senders, and the verdict receivers will compute. It flags the failures that actually cost you deliverability — a missing record, more than 10 DNS lookups (the hard limit at which SPF returns a permanent error), multiple SPF records (also invalid), and soft-fail policies left open with +all.
SPF alone doesn't stop spoofing of the visible From: address — that's what DMARC adds on top. The same report checks DKIM and DMARC alongside SPF so you see the whole authentication picture in one pass.
Methodology & data sources
The check runs live at the moment you submit: we fetch the domain's TXT records over DNS, parse the v=spf1 record, walk every nested include, and count DNS-querying mechanisms against RFC 7208's hard limit of 10. Nothing is served from a stale cache — the record shown is the record receivers resolve at the same instant, and each result carries its own checked-at timestamp.
The same request evaluates DKIM, DMARC and MX in one pass, so the verdicts you see here always agree with the full report's email-authentication section.
Frequently asked questions
What does a valid SPF record look like?
A single TXT record starting with v=spf1, listing your senders (e.g. include:_spf.google.com for Google Workspace), ending in ~all (softfail) or -all (hardfail). One record only — two SPF records is a permanent error.
What is the SPF 10-lookup limit?
Evaluating SPF may trigger at most 10 DNS lookups (includes, a, mx, redirects all count, nested ones too). Exceeding it returns permerror, and many receivers treat that as authentication failure. Flatten rarely-used includes or remove dead vendors to get back under the limit.
Should I use ~all or -all?
-all (hardfail) tells receivers to reject unauthorized senders outright; ~all (softfail) marks them suspicious instead. Start with ~all while you confirm every legitimate sender is listed, then tighten to -all.
Does SPF stop email spoofing by itself?
No. SPF validates the envelope sender, not the From: header users see. Pair it with DKIM (cryptographic signing) and DMARC (policy tying both to the visible From:) for actual spoofing protection.