SPF record checker
Look up any domain's SPF record, expand the full include chain, and count DNS lookups against the limit of 10 — with every mechanism explained in plain English.
- Only the domain name leaves your browser
- Queries go straight to Cloudflare DNS
- Free, no signup
How it works
One domain name in, plain English out
01
Type a domain
Yours, a client's, or one you're investigating. That domain name is the only thing this tool sends anywhere.
02
We query DNS over HTTPS
Your browser asks Cloudflare's public resolver (Google as fallback) for the TXT records, then follows every include and redirect recursively.
03
Plain-English verdicts
Each mechanism explained in one sentence, the DNS-lookup count against the limit of 10, and warnings ranked by severity.
What is an SPF record?
SPF (Sender Policy Framework, RFC 7208) is a TXT record on your domain that says “only these servers may send email for me.” Every receiving mail server checks it on delivery. A correct SPF record is table stakes for deliverability — but it's easy to get subtly wrong: multiple records, too many DNS lookups, or a catch-all that quietly allows the whole internet. This checker finds those problems and tells you exactly what each part of your record does.
FAQ
What is an SPF record?
An SPF (Sender Policy Framework) record is a TXT record on your domain that lists which mail servers are allowed to send email using your domain as the envelope sender. Receiving servers look it up on every delivery and compare the connecting IP against the list. It's one of the three pillars of email authentication, alongside DKIM and DMARC.
How many DNS lookups is an SPF record allowed?
RFC 7208 caps SPF evaluation at 10 DNS-querying mechanisms — include, a, mx, ptr, exists, and the redirect modifier — counted across the whole chain of included records. Go over and receivers return permerror, which many treat as a failure. To get back under the limit, remove includes for services you no longer use, replace a and mx with explicit ip4/ip6 addresses, and consider flattening rarely-changing includes into IP lists (kept up to date).
What's the difference between ~all and -all?
Both end the record and set the default for servers that didn't match anything. ~all is a softfail: receivers accept the message but treat it with suspicion and record the failure — the right choice while you're still confirming every legitimate sender. -all is a hard fail: receivers are told to reject unmatched mail outright. Move to -all once your DMARC reports show all legitimate mail passing.
Does SPF alone stop email spoofing?
No. SPF checks the invisible envelope sender (Return-Path), not the From address people actually see, so a spoofer can pass SPF on their own domain while displaying yours. SPF also breaks on forwarded mail. To protect the visible From address you need DMARC, which requires SPF or DKIM to align with it — check yours with our DMARC checker.
How do I add or fix an SPF record?
In your DNS host or registrar's control panel, add a TXT record on the bare domain (host @ or blank) with a value like v=spf1 include:_spf.google.com ~all — using the include your email provider documents. Keep exactly one v=spf1 record: if one already exists, edit it and merge the mechanisms instead of adding a second. Changes usually propagate within minutes to an hour; re-check here afterwards.
SPF is one leg of the stool. Check your DMARC record and your DKIM keys too — or paste a real message's headers into the email header analyzer to see all three verdicts at once.