Free SPF checker
SPF Record Checker
Free, no sign-up. We only fetch the public URL you enter.
Short answer
Enter a domain above and the SPF checker reads its v=spf1 TXT record, lists every mechanism (include, ip4, ip6, a, mx, redirect, all), counts the DNS lookups against the limit of 10 and flags multiple SPF records, a permissive +all and a missing all at the end. A healthy record has exactly one v=spf1 entry, stays under 10 lookups and ends with ~all or -all. For the website behind the domain, monitordefend checks uptime every five minutes.
- Free, no sign-up: SPF record broken into mechanisms.
- Counts DNS lookups against the limit of 10.
- Flags multiple records, +all and a missing all.
v=spf1 version tag include:_spf.google.com Google Workspace · 1 lookup include:sendgrid.net SendGrid · 1 lookup ip4:203.0.113.25 own server · 0 lookups ~all softfail for everything else DNS lookups: 4 of 10 (nested includes counted)
This free SPF checker validates the SPF record of any domain in seconds. It finds the v=spf1 entry in the domain’s TXT records, breaks it into readable mechanisms, counts the DNS lookups it causes and flags the mistakes that make SPF fail. Use it to confirm which servers are allowed to send email for your domain, to troubleshoot email authentication when messages land in spam, and to check your record after adding a new email provider.
What SPF is
SPF, the Sender Policy Framework, is an email authentication method. The owner of a domain publishes a list of the servers that are allowed to send email on its behalf, and receiving mail providers compare the sending server of every message with that list. A message from an unlisted server is a sign of spoofing, so SPF helps receivers detect forged senders and reduce phishing.
The list lives in DNS as a TXT record on the domain itself and always starts with the version tag v=spf1. There is no separate SPF record type any more; the old type was retired, and only the TXT form counts today.
How the SPF checker works
Enter a domain name such as example.com and start the check. The tool queries the TXT records of the domain, picks out the one that starts with v=spf1 and splits it into its parts, so you can read at a glance which servers and providers you have authorised.
- Email arrives Envelope sender news@myshop.com
- Receiver Reads the SPF record of myshop.com
- Mechanisms Is the sending IP on the list?
- Result pass, softfail, fail or neutral
It then counts how many DNS lookups a receiver needs to evaluate the record, following include and redirect into the records they point to. Finally it flags the configuration errors that break SPF or weaken it: more than one SPF record, a +all that allows everyone, and a record without a closing all mechanism.
- The complete v=spf1 TXT record of the domain
- Every mechanism and modifier, listed one by one
- Total DNS lookups compared with the limit of 10
- Warnings for multiple records, +all and missing all
SPF basics: the mechanisms explained
An SPF record is read from left to right, and the first mechanism that matches the sending IP decides the result. Each mechanism can carry a qualifier: + for pass (the default), ~ for softfail, - for fail and ? for neutral.
- v=spf1 — the version tag; required at the very start
- include: — authorises the sending servers of another provider
- ip4: and ip6: — authorise specific IPv4 or IPv6 addresses and ranges
- a and mx — authorise the addresses of your A or MX records
- redirect= — hands evaluation over to another domain’s record
- all — the default rule at the end, such as -all (fail) or ~all (softfail)
When you should check SPF
SPF breaks quietly. Nothing in your mail program warns you; you only notice when messages are rejected or end up in spam folders. A quick check is worth it in these situations:
- When emails land in spam or get rejected
- After adding a new email provider such as Google Workspace, Microsoft 365 or SendGrid
- When setting up a custom From domain for a newsletter, CRM or helpdesk tool
- After DNS or nameserver changes
- When DMARC reports show SPF failures
The 10-DNS-lookup limit
To protect receivers from overload, the SPF standard allows a record to trigger at most 10 DNS lookups during evaluation. The mechanisms include, a, mx, exists, ptr and the redirect modifier each count, and an include also counts every lookup inside the record it points to. ip4, ip6 and all do not count.
This limit is the most common reason a carefully built SPF record fails with “too many DNS lookups”. Every service you add brings its own include, and large providers nest several further includes inside theirs. Once the total passes 10, receivers return a permanent error and treat the record as broken. The checker adds up the nested lookups for you. If you are over the limit, remove includes for services you no longer use, replace a and mx with explicit ip4 ranges where your addresses are stable, or send bulk mail from a subdomain with its own record.
Should SPF end with ~all or -all?
The all mechanism at the end decides what happens to mail from servers not on your list. ~all is a softfail: receivers should accept the message but treat it as suspicious. -all is a hard fail and tells receivers to reject unauthorised senders. ~all is the safer choice while you are still discovering every system that sends in your name; -all is stricter once you are sure the list is complete.
In practice, many receivers rely on DMARC to decide what to do with a failed check, so the difference is smaller than it looks. What you must avoid is +all, which authorises the entire internet, and a record with no all at all, which leaves unlisted senders at neutral and gives spoofers an easy ride.
One SPF record per domain
A hostname may publish only one SPF record. Two TXT entries that both start with v=spf1 cause a permanent error, and receivers then ignore SPF completely. This happens easily: a new provider’s setup guide says “add this TXT record”, and the old one stays in place.
The fix is to merge everything into a single policy. Take the mechanisms of both records, write them into one line after a single v=spf1 and end it with one all. If you use Google Workspace and Microsoft 365 together, for example, the merged record would read v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all.
SPF, the visible From address and DMARC
SPF does not check the From address your recipients see in Gmail or Outlook. It checks the envelope sender, often shown as Return-Path, which newsletter and transactional mail services frequently set to their own domain. A message can therefore pass SPF while showing a completely different From address.
DMARC closes this gap by requiring alignment: the domain that passed SPF or DKIM must match the visible From domain. That is why SPF works best together with DKIM and a DMARC policy, and why it is worth checking all three after every change to your sending setup.
Beyond email: your website
monitordefend does not monitor SPF or other DNS records; run this checker whenever you change your mail setup. It watches the website on the same domain instead: uptime and response time every five minutes, with an email when the site goes down.
Frequently asked questions
What happens if a domain has no SPF record?
Receivers get no statement about which servers may send for the domain, so the SPF result is none. Mail is not automatically rejected, but spam filters weigh it more critically, and DMARC can then only rely on DKIM. Domains that never send email should publish v=spf1 -all so nobody can send in their name.
How do I fix too many DNS lookups in SPF?
Remove includes of services you no longer use, replace includes with fixed ip4 or ip6 ranges where the provider documents stable addresses, and avoid the a, mx and ptr mechanisms when they are not needed. Some teams move secondary senders to a subdomain with its own SPF record.
How do I check the SPF record for my domain?
Enter your domain in the SPF checker above. It finds the SPF policy published as a TXT record, shows it in a readable format and lists each mechanism along with the number of DNS lookups.
What does a good SPF record look like?
It starts with v=spf1, lists your allowed senders with include, ip4 or ip6, stays under 10 DNS lookups and ends with ~all or -all. There is only one such record on the domain.
Should my SPF end with ~all or -all?
~all is a softer policy that suits testing and gradual rollouts; -all is stricter and tells receivers to reject unauthorised senders. Never use +all.
Why does my SPF check fail with too many DNS lookups?
SPF evaluation is limited to 10 DNS lookups. Each include, a, mx, exists and redirect counts, including those nested inside included records. Remove unused includes or replace them with ip4 and ip6 ranges.
Does SPF validate the From address people see in Gmail?
Not directly. SPF checks the envelope sender, often shown as Return-Path. DMARC ties SPF and DKIM back to the visible From domain through alignment.
Can I have more than one SPF record?
No. Multiple v=spf1 records on the same hostname break evaluation with a permanent error. Combine all mechanisms into a single SPF policy.
What SPF record should I use for Google Workspace or Microsoft 365?
Google Workspace typically uses v=spf1 include:_spf.google.com ~all, and Microsoft 365 requires include:spf.protection.outlook.com. If you use both, put both includes into one record.