Free SPF Record Checker
Check your domain's SPF record, see which servers are authorised to send email as you, and catch the misconfigurations that silently break delivery.
SPF is a public list of the servers allowed to send email for your domain. Receiving servers look it up to decide whether a message claiming to be from you actually came from somewhere you approved.
It is also easy to get subtly wrong in ways nothing warns you about. This free check reads your SPF record and flags the specific failure modes — duplicate records, exceeded lookup limits, missing senders — that cause mail to start failing without any error message.
What this tool checks
SPF record present
Whether a v=spf1 TXT record exists on the root domain.
Only one record
The spec allows exactly one. Two records means both are invalid and all mail fails.
Authorised senders
Which providers your record includes — and whether an obvious one is missing.
The all mechanism
Whether you end in ~all (soft fail), -all (hard fail) or the far too permissive +all.
DNS lookup count
SPF permits a maximum of ten lookups. Exceed it and the whole record fails.
DMARC pairing
Whether a DMARC policy exists to act on SPF results — without one, failures are usually delivered anyway.
Why it matters
The most common SPF problem is not a missing record — it is an incomplete one. Your newsletter tool, invoicing software, CRM and helpdesk all send mail as you. Miss one and its messages start landing in spam, usually weeks after someone added the service and nobody thought about DNS.
The ten-lookup limit catches people out badly. Each include: costs at least one lookup, and a business using six or seven services quietly exceeds it. Once you do, the record fails entirely — and there is no warning anywhere.
How to read your results
- Two SPF records is an emergency, not a warning. Merge them into one line immediately — while both exist, all your mail is failing authentication.
- If the lookup count is at or above ten, the record is already failing. Flatten some includes or consolidate sending services.
- Ending in +all authorises the entire internet to send as you. It is equivalent to having no SPF at all.
- List every service that sends mail on your behalf before editing, then confirm each one appears in the record.
Frequently asked questions
What does an SPF record look like?
A TXT record on your root domain, for example: v=spf1 include:_spf.google.com include:sendgrid.net ~all. Each include: names a provider allowed to send for you, and the final mechanism says what to do with everyone else.
Can I have two SPF records?
No. The specification permits exactly one. Publishing two makes both invalid and causes every message to fail SPF — this is one of the most common and most damaging mistakes.
What is the ten DNS lookup limit?
Evaluating SPF may trigger at most ten DNS lookups. Each include: costs one or more. Exceed the limit and the record returns a permanent error, which most receivers treat as a failure.
Should I use ~all or -all?
~all is a soft fail — flag but usually deliver. -all is a hard fail — reject. Start with ~all until you are confident every legitimate sender is listed, then tighten to -all.
Is SPF enough on its own?
No. SPF breaks when mail is forwarded, and on its own it rarely causes a forgery to be blocked. Pair it with DKIM and a DMARC policy that tells receivers what to do.
SPF, DKIM and DMARC Explained (And Why Your Email Goes to Spam) →
More free tools
Want the full picture?
Run a complete siteIQ audit — security, performance, SEO, accessibility and infrastructure — 65+ checks across 8 categories, in one report.