SPF record checker and validatorSPF record check
Expands your domain's SPF record through every include, counts the DNS lookups it spends and flags the mistakes that send your mail to spam.
What this check looks at
- The SPF (TXT) record on your domain
- The full include and redirect tree
- The 10-lookup and 2-void-lookup limits
- The all qualifier, ptr and syntax
- Unregistered include domains (RDAP)
What it reads and what it doesn't
DNS only: your domain's TXT record, the TXT record of every domain reached through include and redirect, and the registration status of include domains (RDAP). No email is sent and no connection is made to your mail server.
What is an SPF record?
SPF (Sender Policy Framework) is a TXT record that lists the servers allowed to send email for your domain. The receiving server compares the sending IP with that list. A record can pull in other providers' lists with include, but evaluating it may cost no more than 10 DNS lookups in total. Go over the limit and the record is treated as invalid, so your mail fails authentication.
DNS only: your domain's TXT record, the TXT record of every domain reached through include and redirect, and the registration status of include domains (RDAP). No email is sent and no connection is made to your mail server.
How to read the result
- DNS lookups (max 10)
- include, a, mx, ptr, exists and redirect each cost one lookup, and so do the ones inside every record you include. ip4 and ip6 cost nothing.
- Void lookups (max 2)
- A lookup that comes back empty, such as an include of a provider whose record was deleted. More than two makes the record invalid.
- -all
- Mail from servers not on the list is rejected. Together with DMARC this is the strictest setting.
- ~all
- Mail from servers not on the list is marked suspicious but not rejected. If your DMARC policy is reject, this is enough in practice.
- ?all and +all
- ?all says nothing at all; +all lets anyone send as you. Both make SPF useless.
Common problems and how to fix them
Every issue this check can flag, why it matters and what to change in DNS.
No SPF record
Why it matters: Receivers can't tell which servers may send for you, so spoofed mail gets through more easily. Since February 2024 Google and Yahoo require SPF or DKIM from every sender.
What to do: Add a single TXT record at the root of your domain. Use the include value your email provider gives you and end the record with -all or ~all.
example.com. TXT "v=spf1 include:_spf.google.com ~all"More than one SPF record
Why it matters: RFC 7208 allows one SPF record per domain. With two, receivers return a permanent error and ignore both.
What to do: Merge them into one record: put every include and ip4/ip6 value into the same v=spf1 record and delete the other.
; one record instead of twoexample.com. TXT "v=spf1 include:_spf.google.com include:spf.brevo.com ~all"Over the 10 DNS lookup limit
Why it matters: Over the limit, receivers return a permanent error (permerror). For DMARC that counts as an SPF failure, and your mail can land in spam.
What to do: Remove includes for providers you no longer use. Drop needless a and mx mechanisms, and list servers with fixed IPs as ip4/ip6, which cost no lookups. Moving bulk or marketing mail to a subdomain (news.example.com) with its own SPF record also frees up room.
Include without an SPF record
Why it matters: Including a domain that has no SPF record is a permanent error. Usually the record of a service you stopped using was deleted.
What to do: Remove this include. If you still use the service, ask the provider for its current SPF value.
Unregistered include domain
Why it matters: Anyone can buy this domain today. Whoever does can list any server in its SPF record and send mail as you that passes SPF.
What to do: Remove this include right away. If the domain is yours and has expired, renew it.
+all allows everyone
Why it matters: +all authorizes every server in the world to send as you. It's no better than having no SPF record, and arguably worse.
What to do: Replace +all with -all or ~all.
example.com. TXT "v=spf1 include:_spf.google.com -all"~all softfail
Why it matters: Mail from unlisted servers is marked suspicious but not rejected. With a DMARC policy of reject this is a common, accepted setup.
What to do: If every sender you use is listed, you can move to -all. The real protection comes from DMARC p=reject.
ptr mechanism
Why it matters: RFC 7208 says ptr should not be used: it's slow, costs many lookups and some receivers ignore it.
What to do: Remove ptr and list your servers with ip4/ip6 or include.
Frequently asked questions
- How do I check my SPF record?
- Enter your domain above. The check reads the TXT record starting with v=spf1, expands every domain it includes and counts the total DNS lookups. On the command line, dig TXT example.com shows the first level only; following the chain and counting by hand is tedious.
- How is the SPF 10 DNS lookup limit counted?
- include, a, mx, ptr, exists and redirect count as one lookup each, and the same mechanisms inside every record you include are added to the total. ip4, ip6 and all are free. Google Workspace costs one lookup through a single include, while some marketing tools cost three or four.
- Should I use ~all or -all?
- With a DMARC policy of p=reject, both work, and ~all lowers the risk of losing legitimate mail through a misconfigured forwarder. With no DMARC or p=none, -all sends the clearer signal. Avoid +all and ?all in every case.
- I use two email services. Do I need two SPF records?
- No. A domain has one SPF record. Put both services' include values in the same record: v=spf1 include:first include:second ~all.
Primary sources
More quick checks
Each one answers a single question about a single record. No account needed.
DKIM record check
Finds your DKIM signing key in DNS, reads its type and length, and flags keys that are weak, stuck in test mode or revoked.
DMARC record check
Breaks your DMARC record down tag by tag: what happens to spoofed mail, where reports go and whether external report addresses are authorized.
MX lookup
Shows which servers receive email for your domain, in priority order, with each server's address, reverse DNS and provider.
Is it down?
Tries to open the site from two separate locations and tells you whether it's down for everyone or just for your connection.
SSL expiry check
Shows when your certificate expires, how many days are left and who issued it. Checks the apex and www separately and adds a calendar reminder.
To see every check in one report:Email security check