How to Use the SPF Checker
To check SPF for a domain, enter the sending domain and read the lookup count, errors and warnings in that order.
- Enter the domain you send mail from, such as example.com.
- Select Check SPF to read the TXT record that starts with v=spf1 and follow every include and redirect.
- Check the DNS lookup count first, then fix any validation errors and review the warnings.
- If the record is missing, open the record builder below the tool or use the SPF Record Generator, then publish the draft in your DNS.
SPF Record Check
An SPF record check confirms that the domain publishes one valid record that receivers can evaluate within ten DNS lookups.
SPF Record Check Syntax
The record must start with v=spf1, and every term after it must be a known mechanism or modifier. The checker flags invalid IP addresses and CIDR prefixes, more than one redirect, and an unrestricted +all that authorizes every sender. It also warns about the deprecated ptr mechanism and a record without a final all or redirect.
SPF Lookup Limit
SPF allows at most ten terms that need a DNS query, such as include, a, mx, exists and redirect. The checker counts these terms across every nested record and reports the total out of 10. A count above ten produces a permanent error, so the record fails for every message.
Domain SPF Checker
Each include and redirect points to another domain’s SPF record, which the checker reads in turn. It reports a missing record, more than one SPF record at the same name and include loops at every level. Includes that depend on macros cannot be resolved without a real message and are listed as warnings.
SPF Softfail vs Hardfail
Softfail (~all) marks unlisted senders as suspicious, while hardfail (-all) tells receivers that they are not authorized at all.
| Qualifier | Result for unlisted senders | Typical use |
|---|---|---|
| ~all (softfail) | Accepted but marked as suspicious | Most domains, especially while senders are being added |
| -all (hardfail) | Not authorized and may be rejected | Domains whose list of senders is complete |
| ?all (neutral) | No statement about the sender | Testing only, because it protects nothing |
Frequently Asked Questions
What Is an SPF Checker?
An SPF checker reads the SPF record a domain publishes in DNS and tests it for errors. This one checks the syntax and the lookup count, but it does not test a particular message or sending IP address.
How Do You Check If Your SPF Record Is Correct?
Run the check and confirm that it shows no errors and ten or fewer DNS lookups. Then compare the record with the list of services that send mail for you, because a valid record can still miss one of them.
What Does SPF Check Failed Mean?
It means the sending server’s IP address is not authorized by the domain’s SPF record, or the record itself returned an error. Add the missing service to the record, or fix the error this checker reports.
Is SPF a DNS Record?
Yes. SPF is published as a TXT record on the domain that starts with v=spf1. A domain must have only one, so merge all services into a single record.
Related Email Tools
Continue with the guide How to Create an SPF Record. Authorize your legitimate sending services.