Free SPF Record Checker Online

What is an SPF record?

SPF (Sender Policy Framework) is a DNS TXT record that specifies which mail servers are authorized to send email on behalf of your domain. It is one of the key email authentication protocols, alongside DKIM and DMARC, that helps prevent email spoofing and phishing attacks.

An SPF record starts with v=spf1 and contains a list of mechanisms that define which servers can send mail for the domain. For example:

v=spf1 include:_spf.google.com ~all

This record allows Google's mail servers to send email on behalf of the domain, and soft-fails everything else.

How to use the SPF record checker?

Checking the SPF record of any domain takes a few seconds and requires no signup. Follow these steps:

• Enter the domain: Type the domain name you want to check, such as example.com. You do not need to include http:// or www, the tool strips those automatically.
• Click Check SPF Record: The tool queries Cloudflare's DNS over HTTPS API to fetch the TXT records published for the domain.
• View the results: See the raw SPF record, each parsed mechanism with its qualifier, and any other TXT records found on the domain.
• Copy the record: Use the copy button to copy the raw SPF record to your clipboard for auditing or updating your DNS.

SPF mechanisms explained

An SPF record is built from mechanisms, and each one authorizes a set of sending servers. These are the mechanisms you will see in the parsed results:

• include: Authorizes the SPF record of another domain (e.g., include:_spf.google.com)
• ip4: Authorizes a specific IPv4 address or CIDR range (e.g., ip4:192.168.1.0/24)
• ip6: Authorizes a specific IPv6 address or range
• a: Authorizes the A record IP of the domain
• mx: Authorizes the domain's MX record IPs, which you can list with the MX record lookup tool
• all: Matches everything and is used as the final catch-all mechanism
• redirect= Points to another domain's SPF record entirely
• exists: Advanced macro-based mechanism for conditional checks

SPF qualifiers and what they mean

Each mechanism in an SPF record can have a qualifier prefix that determines what happens when a match occurs:

Common SPF configuration mistakes

Most SPF failures trace back to a handful of avoidable configuration errors. Watch for these mistakes when you review a record:

• Multiple SPF Records: A domain must have only one SPF record. Having two or more is invalid per RFC 7208 and may cause unpredictable email delivery.
• Exceeding 10 DNS Lookups: SPF has a limit of 10 DNS lookups. Using too many include: mechanisms can exceed this limit and cause a PermError.
• Using +all: Setting +all authorizes any server to send email, effectively disabling SPF protection. Always use ~all or -all.
• Missing SPF Record: Not having an SPF record at all can lead to email delivery issues and makes your domain vulnerable to spoofing. SPF works best alongside a DMARC policy, which you can validate with the DMARC record checker.
• Using PTR: The ptr mechanism is deprecated (RFC 7208) due to performance issues. Use ip4/ip6 instead.
• Expecting Instant Updates: DNS changes take time to spread across resolvers. After publishing a new SPF record, confirm it is visible worldwide with the DNS propagation checker before re-testing delivery.
• Editing the Wrong Record: Before changing DNS, confirm which check actually failed by reading the raw message headers with the Email Header Analyzer, which shows the SPF, DKIM, and DMARC results the receiving server recorded.

Frequently Asked Questions (FAQs)

What is an SPF record?

An SPF (Sender Policy Framework) record is a DNS TXT record that specifies which mail servers are authorized to send email on behalf of a domain. It helps prevent email spoofing and phishing.

How does an SPF Checker work?

An SPF Checker queries the DNS TXT records for a given domain, identifies the SPF record (starting with v=spf1), and parses its mechanisms such as include, ip4, ip6, mx, a, and the all qualifier.

What does ~all mean in an SPF record?

The ~all mechanism means SoftFail, so emails from non-authorized servers are accepted but marked as suspicious. The -all qualifier means hard fail (reject), +all means allow all (not recommended), and ?all means neutral.

Can a domain have multiple SPF records?

No, a domain should have only one SPF record. Having multiple SPF records is a configuration error per RFC 7208 and may cause email delivery issues. Multiple records should be merged into one.

What is the SPF 10 DNS lookup limit?

SPF has a limit of 10 DNS lookups (including include, a, mx, ptr, exists, and redirect mechanisms). Exceeding this limit causes a PermError, which may result in email delivery failures.

Does the SPF checker send my domain name to a server?

Yes. SPF records live on public name servers, so they cannot be read without a network query. The tool sends only the domain name you enter to Cloudflare's public DNS over HTTPS resolver. No email content, credentials, or personal data are involved, and no signup is required.

Is SPF alone enough to stop email spoofing?

No. SPF only validates the sending server against the envelope sender, and it can break on forwarded mail. For dependable protection, pair SPF with DKIM signatures and a DMARC policy so receiving servers know how to treat messages that fail authentication.

How do I add or fix an SPF record for my domain?

Create a single TXT record at your DNS provider that starts with v=spf1, list your authorized senders with include, ip4, or mx mechanisms, and end with ~all or -all. Publish the change, allow DNS time to update, then run this checker again to confirm.