What SPF checks
SPF tells receivers which servers are allowed to send email for a domain. A valid SPF record helps prevent unauthorized servers from passing as your domain.
Free outbound tool
Free SPF Record Checker
Check SPF syntax, find multiple records, and inspect recursive include and redirect lookup terms. Lint a proposed TXT record or query published DNS.
live
SPF record checker
SPF syntax checks, duplicate-record detection and bounded recursive include/redirect inspection.
Inspect a published policy or lint a proposed TXT value. This does not test an actual sending IP, the visible From address, DMARC alignment or inbox placement.
Not checked yet. No DNS or authorization result is available.
What this inspection leaves unknown
We expand literal include and redirect targets, count a, mx, ptr and exists as terms, and skip mechanisms after all plus redirects overridden by all. Repeated dependencies count again even when their TXT answer is cached. Macro targets are linted but not expanded.
We do not resolve A/AAAA, MX host addresses, PTR or exists answers, expand sender macros, or fetch exp text. Their DNS failures, the recommended two-void-lookup limit and the separate MX/PTR address limits remain unchecked. A full tree can include branches no single sender reaches. An over-ten total flags risk; it is not a universal permerror verdict.
Safety limits: 20 TXT queries, 40 record visits, 12 levels, 8 seconds overall; 1.5 seconds per resolver attempt. These are tool limits, not SPF protocol limits. Unknown results require a retry or a full sender-specific test.
After fixing SPF, inspect your DMARC policy for alignment handling and look up your provider’s DKIM selector for signing-key publication. Use the email deliverability stack to plan the monitoring and sending controls these DNS checks cannot replace.
Technical reference: RFC 7208, sections 3–7. Method reviewed August 31, 2026.
How to get more from this tool
SPF best practices
Publish one SPF policy for the exact MAIL FROM domain. Inventory every legitimate sender before removing stale services or changing the final qualifier. An include count alone misses nested policies and other DNS-triggering terms.
Common SPF errors
Multiple SPF records, unknown mechanisms, malformed IP ranges and duplicate redirect/exp modifiers need correction. A missing include target causes permerror if reached. Timeout or SERVFAIL means the DNS check is incomplete, not that a policy is absent.
Frequently asked questions
What is SPF?
SPF stands for Sender Policy Framework. It is a DNS TXT record that lists the servers authorized to send email for a domain.
Can a domain have multiple SPF records?
No. A domain should have exactly one SPF record. Multiple SPF records can cause validation failures.
What is the SPF DNS lookup limit?
RFC 7208 limits evaluated include, a, mx, ptr, exists and redirect terms to ten across recursive evaluation. Root TXT retrieval and ip4, ip6, all and exp do not count toward that limit. This checker reports a conservative expanded total; actual sending-IP paths can stop earlier.
What is the difference between ~all and -all?
~all is a softfail that signals unauthorized senders are suspicious. -all is a hardfail that signals unauthorized senders should fail SPF.
Related free tools
Email deliverability test
Inspect public DNS and message text with clear next steps. Inbox placement and reputation are not measured.
Email spam checker
Review plain-text email with highlighted copy notes, unresolved tokens and practical next steps.
DMARC checker
Live TXT lookup with plain-English interpretation of p=none, quarantine, reject, rua, and pct.
DKIM checker
Selector-specific DNS lookup with public-key syntax checks and clear next steps.