SPF Record Checker
Finds your SPF record, counts its DNS lookups through every include against the limit of 10, flags void lookups and duplicate records, and reads the all qualifier against your DMARC policy.
@emailens/engine 0.17.2 · data last changed 27 Oct 2026
Example: example.com, a made-up domain with a sample SPF record. Check yours above.
passexample.com
SPF configured with ~all (softfail) aligned with DMARC policy.
Standard recommended configuration for cloud and SaaS senders when paired with DMARC enforcement.
TXT example.com
v=spf1 mx include:_spf.example.com ~all
Evaluation
Pass: No PermError
DNS lookups2 / 10
Each include, redirect, a, mx, ptr and exists costs one, counted through every nested include. Past 10, receivers stop with a PermError.
Void lookups0 / 2
Includes or redirects that point at a domain with no SPF record. Past 2, receivers stop with a PermError.
The all qualifier
- -allHardfail: mail from any server not listed fails SPF.
- ~allYours. Softfail: unlisted servers fail softly, so the message is suspect rather than refused. DMARC decides what happens to it.
- ?allNeutral: the record makes no claim about unlisted servers.
- +allPass: every server in the world passes SPF for your domain, so anyone can send as you.
- noneNo all mechanism: an unlisted server matches nothing and gets a neutral result.
SPF gets the email to the inbox; the HTML decides how it looks there. Open the checker and paste it: five clients, no account.
No signup · Five clients free, Outlook Classic included · All 21 with an account
Which clients need an account
Gmail Android, Gmail iOS, Outlook 365, Outlook iOS, Outlook Android, Outlook for Mac, Apple Mail, Yahoo Mail Android, Yahoo Mail iOS, Samsung Mail, Thunderbird, HEY Mail, Proton Mail, AOL Mail, Fastmail, Superhuman open with a free account.
The checker needs a computer screen.
What each check reads
- Record
- Reads the TXT records on your domain and keeps those starting with v=spf1. None is a fail; more than one is a PermError, and the check stops there.
- Lookups
- Follows every include and redirect, nested ones too, and counts the terms that cost a DNS query: include, redirect, a, mx, ptr and exists. More than 10 is a PermError.
- Void
- Counts includes and redirects whose target publishes no SPF record. More than 2 is a PermError. A ptr term, or an include loop, is noted as a warning.
- all
- Reads how the record ends. +all fails, ?all or no all is a warning, -all passes, and ~all passes only when DMARC is at p=quarantine or p=reject.
SPF is one of three records. Check DKIM and DMARC next, or read how they fit together.
Your next question
- Is my DKIM key published, and is it strong enough?
- Is my DMARC policy enforced?
- Check SPF, DKIM, DMARC, MX and BIMI at once.
- How do SPF, DKIM and DMARC fit together? Read the guide.
Other free tools: BIMI Checker · DMARC Report Reader · DMARC Record Generator · Email Header Analyzer · Email Spam Checker
Run this check on every email
A free account re-checks your records every day (1 monitored domain) and emails you when one changes: Watch your domain daily, free.
SPF, DKIM and DMARC monitoring (Dev). Dev is $9 a month. For one developer: 100 checks a day, an API key and a test inbox. See the plans →
Questions
What does an SPF checker check?
This one finds the v=spf1 TXT record on your domain, flags a second record, follows every include to count the DNS lookups against the limit of 10, counts includes that point at nothing, and reads the all qualifier at the end. It also reads your DMARC policy, because ~all only protects you when DMARC is enforced.
What is the SPF 10 DNS lookup limit?
RFC 7208 caps an SPF evaluation at 10 terms that need a DNS query: include, a, mx, ptr, exists and redirect, counted through every nested include. ip4 and ip6 cost nothing. Past 10, receivers return a PermError and SPF fails for all your mail. Remove includes for services you no longer use, or move a sender to its own subdomain with its own record.
Should SPF end in ~all or -all?
~all (softfail) marks unlisted servers as suspect and leaves the decision to DMARC; -all (hardfail) marks them as failing. This check passes -all, and passes ~all when DMARC is at p=quarantine or p=reject, because without enforcement a softfail stops nothing. Never use +all: it authorizes every server in the world.
Can a domain have two SPF records?
No. RFC 7208 allows one v=spf1 record per domain; with two, receivers return a PermError and SPF fails. It usually happens when a new provider's setup guide says to add a record. Merge the includes into one record and delete the other.
Does SPF stop people spoofing my From address?
Not on its own. SPF checks the envelope sender (the Return-Path), not the From address people see. DMARC ties the two together: it passes only when SPF or DKIM passes for a domain that aligns with the From domain, and its policy tells receivers what to do when neither does.