SPF record checker

How do I read an SPF record?

What is the SPF 10 lookup limit?

Why is SPF alone not enough?

How do I check my SPF record?

1. 1Type the domain into the box. Use the domain in your From address, or the bounce domain your email service uses.
2. 2Press Check SPF. The tool fetches the domain's TXT records and finds the one starting v=spf1.
3. 3Read the verdict, the record mechanism by mechanism, and the DNS lookup count against the limit of 10. It flags a missing record, two records, +all, ?all and a record with no all at the end.
4. 4If a sender is missing, rebuild the record with the SPF generator and check again once DNS updates.

Example

You enter

The domain acme.example.

You get

SPF record found: v=spf1 include:_spf.google.com ~all. It soft-fails unlisted senders (~all), marking them suspect instead of rejecting them.

Limits

Ten lookups a minute per IP address, one domain at a time; a DNS lookup only.

Who uses this tool, and for what?

IT admins

Check the record after adding a new sending service, and before the change reaches users, to catch a second v=spf1 record that breaks SPF entirely.

Cold emailers

Confirm each outreach domain authorises its mailbox provider before warm-up starts. A missing record is one of the most common reasons new domains land in spam.

Agencies

Audit a new client's domain in seconds and send them the raw record with the problem marked.

What can’t this tool tell you?

• It reads the record. It does not send a test message, so it can't tell you whether a given server's mail actually passes SPF.
• SPF checks the envelope sender (Return-Path), which is often your email service's domain rather than yours. Check that domain too.
• A record that looks right can still exceed the ten-lookup limit once nested includes are counted.
• DNS answers are cached, so a change made minutes ago may not show yet.

Sources

• RFC 7208: Sender Policy Framework (SPF)
• RFC 7208, section 4.6.4: the ten-lookup limit
• Google: email sender guidelines

Common questions

How do I check my SPF record?

Paste your domain into the tool above. It looks up the TXT records, finds the one beginning v=spf1, explains each mechanism, counts the DNS lookups the include chain costs, and lists what to fix in plain English. You can also check any domain you do not control.

What does ~all mean in an SPF record?

It is a soft fail. Mail from a server not authorised by the record should be accepted but treated as suspicious, usually meaning it is more likely to be filed as spam. `-all` is the stricter form and asks receivers to reject outright; most organisations move from ~all to -all once they are confident every legitimate sender is listed.

What does SPF check failed mean?

The server that sent the message is not authorised by the SPF record of the envelope sender's domain. The usual causes are a sending service that was never added to the record, a record over the ten-lookup limit, or a message forwarded through another server.

How do I check an SPF record with nslookup?

Run nslookup -type=txt example.com, or dig txt example.com on Mac and Linux, with your domain in place of example.com. Look for the one TXT record that starts v=spf1. If two start v=spf1, SPF fails for every message until you merge them.

How do I check SPF, DKIM and DMARC records together?

Run the deliverability audit, which checks MX, SPF, DKIM, DMARC and blocklists for a domain in one pass. To see whether they passed on a specific message, paste its headers into the email header analyzer.

Can a domain have two SPF records?

No. Publishing two records beginning v=spf1 is invalid and causes SPF evaluation to fail entirely, so the effect is worse than having one imperfect record. If you need to authorise an extra vendor, add its mechanism to the existing record rather than publishing a second one.

What is the SPF ten-lookup limit?

SPF allows at most ten DNS lookups per evaluation, and each include, a, mx, ptr and exists mechanism consumes one. Exceeding it makes the record fail with a permanent error rather than partially applying, and adding one vendor too many is the usual cause of SPF that worked until recently.

How do I check MX, SPF, DKIM and DMARC at once?

Run the deliverability audit: this page covers one record, and the full deliverability audit runs MX, SPF, DKIM, DMARC and blocklists together and scores the domain. Just bought a domain to send from? The new domain email setup check checks up to 25 at once and gives the exact Google Workspace, Microsoft 365 or Zoho records to add, or read the glossary entry for the concept behind this check.

Embed this tool on your site

Paste this code into any page to give your readers the SPF record checker for free. The frame resizes to fit and works on light and dark pages. Keep the link under it so readers can find the full guide. More tools to embed are on the embeddable tools page.

<iframe src="https://simpleverifier.com/embed/tools/spf-checker" title="SPF record checker by SimpleVerifier" data-sv-embed="spf-checker" width="100%" height="640" loading="lazy" allow="clipboard-write" style="border:0;width:100%;max-width:760px;display:block"></iframe>
<p style="margin:6px 0 0;font-size:13px"><a href="https://simpleverifier.com/tools/spf-checker">Free SPF record checker by SimpleVerifier</a></p>
<script>(function(){if(window.__svEmbed)return;window.__svEmbed=1;window.addEventListener("message",function(e){if(e.origin!=="https://simpleverifier.com")return;var d=e.data;if(!d||d.type!=="simpleverifier:embed-height"||typeof d.slug!=="string"||typeof d.height!=="number"||!isFinite(d.height))return;var f=document.querySelectorAll("iframe[data-sv-embed]");for(var i=0;i<f.length;i++){if(f[i].contentWindow===e.source){f[i].style.height=Math.min(Math.max(Math.ceil(d.height),200),4000)+"px";}}});})();</script>