SPF checker
Look up a domain's SPF record and validate it: every include followed, every DNS lookup counted, and the mistakes that get mail rejected flagged.
Related tools: MX lookup · DMARC checker · DKIM checker · All free tools
Who may send mail as this domain
An SPF record is a TXT record starting with v=spf1 that lists the servers allowed to send email for a domain, so receivers can reject forgeries. This tool fetches the record from Cloudflare's 1.1.1.1 resolver, parses each mechanism, follows every include and redirect to the records they point at, and counts the DNS lookups the whole tree costs against the limit of ten that receivers enforce. Anything over the limit, or a second SPF record, or a +all at the end, is reported with what to do about it.
SPF is checked once here; the records it depends on change whenever a provider updates its include. Upcheck's DNS check watches the records that take a site down, and re-resolves every website every 6 hours, MX records included.
Three steps, no signup
- 01
Enter a domain
The domain in the From address of the mail you send, such as example.com.
- 02
We fetch and follow the record
The TXT records are read from a public resolver, the SPF record is parsed, and each include and redirect is fetched in turn.
- 03
The verdict comes back with the reasons
Lookup count, the all mechanism, and every error and warning, with the include tree laid out beneath.
Frequently asked questions
What is an SPF record?
Sender Policy Framework: a TXT record on a domain that says which mail servers are allowed to send email claiming to be from that domain. A receiving server checks the sending server's address against the record and gets a result of pass, fail, softfail, or neutral, which feeds into spam filtering and into DMARC. A domain without SPF is easy to forge.
What is the SPF 10 lookup limit?
Evaluating an SPF record can require DNS lookups: include, a, mx, ptr, exists, and redirect each cost one, and includes pull in their own records with their own lookups. RFC 7208 caps the total at ten. Over that, receivers return permerror and treat the record as if it didn't exist, which means your mail is unauthenticated. Big providers' includes often cost several lookups each, so it is easy to hit the limit by adding one more service.
How do I fix 'too many DNS lookups'?
Remove includes for services you no longer send through; that is the usual cause. Replace a and mx mechanisms with the ip4 and ip6 addresses they resolve to, which cost no lookups. If you still can't fit, some providers offer SPF flattening, which rewrites the record as explicit addresses and keeps it updated; it works, at the cost of a dependency on that provider.
What is the difference between ~all and -all?
Both say every server not listed should fail; the qualifier says how hard. -all is a hard fail, which receivers may act on directly. ~all is a soft fail: the mail is marked but usually delivered, and DMARC still counts it as a failure. ~all is the safer choice while you are unsure the record is complete; -all once you are. +all authorises everyone and defeats the record; ?all is neutral and does almost nothing.
I have two SPF records. Which one wins?
Neither. A domain must publish exactly one v=spf1 record; receivers that find two return permerror and treat the domain as having none. This happens when a second service's setup guide says 'add this TXT record' and it gets added beside the existing one instead of merged into it. Combine the mechanisms into a single record.
Is this SPF checker free?
Yes. No account, no limit on checks by hand; scripted use is rate limited because each check can follow several includes. Upcheck's paid product monitors the DNS records your website depends on every 6 hours and alerts your team when one changes.
One check validates the record. Monitoring watches the zone it lives in.
Add your domains to Upcheck and get alerted by email, Slack, Discord, Teams, or webhook when the records that matter change.