SPF check: test your SPF record and count lookups
Check whether your domain's SPF record is valid, which servers may send in your name and whether you stay below the limit of 10 DNS lookups.
Check SPF record
Enter the domain you send email from, for example your-domain.co.uk.
Lookups run through the Quad9 DNS resolver (Switzerland). We keep the checked domain and an anonymised IP address for no longer than 30 days.
How SPF works
What is SPF?
The Sender Policy Framework is a TXT record that starts with v=spf1. In it you define which servers may send email with your domain as the sender. The receiving server compares the IP address of the delivering server with this list and then knows whether the message comes from a permitted sender.
Mechanisms and the end of the record
ip4: and ip6: allow fixed addresses, a and mx the servers behind your A and MX records, and include: takes over the SPF record of a service provider, such as your newsletter tool. The record ends with all and a qualifier: -all rejects everyone else, ~all marks them as suspicious. +all allows every server in the world and renders SPF useless.
The limit of 10 DNS lookups
Every include, a, mx, exists, ptr and redirect costs the receiver one DNS lookup – including those inside included records. More than 10 are not allowed: the receiver then stops with an error and your SPF no longer protects anything. Our check follows the complete include chain and keeps count.
Common SPF mistakes
Several SPF records
A domain may only have one record starting with v=spf1. With two, receivers treat SPF as an error. Merge all mechanisms into one record.
More than 10 lookups
Every new tool brings another include. Remove services you no longer use and, where possible, replace includes with fixed ip4 ranges.
+all or ?all at the end
With +all anyone may send in your name, and ?all says nothing. Use ~all while setting up and -all once every sender is listed.
Include pointing to a domain without SPF
If an include points to a domain that has no SPF record (any more), your whole record is invalid. This often happens when a service provider changes its SPF address.
Frequently asked questions
Enter your domain above. The SPF check shows the record, resolves every include, counts the DNS lookups and assesses the closing all. We explain errors and warnings right in the result.
-all is stricter: email from servers not listed should be rejected. ~all only marks it as suspicious. Start with ~all, use DMARC reports to check that every legitimate sender is listed, then switch to -all.
The receiving server aborts the check with a permanent error (permerror). Depending on its settings, your email then lands in spam or DMARC fails. Reduce the number of includes until you are back at 10 or fewer.
As a TXT record directly on your domain, without a subdomain in front, in your host's DNS management. There must be only one SPF record, so extend an existing one rather than adding a second.
Yes, especially then. With v=spf1 -all you tell every receiver that no email ever comes from your domain. This makes it harder for fraudsters to misuse your domain for phishing.
No. SPF only checks the technical sender, not the address the recipient sees in From. Only DMARC links the two and decides what happens to forged email. So check your DMARC record too.
