SPF checker FAQs
What is an SPF record?
SPF (Sender Policy Framework) is a DNS TXT record that lists the mail servers authorized to send email on behalf of your domain. Receiving servers check the SPF record to verify the sender is legitimate.
What does an SPF checker do?
An SPF checker retrieves your domain's SPF record from DNS, parses each mechanism, counts DNS lookups (including nested includes) against the 10-lookup limit, and identifies security issues like a missing -all or ~all, +all, or multiple SPF records.
What is the 10 DNS lookup limit?
RFC 7208 limits SPF evaluation to 10 DNS-querying mechanisms (include, a, mx, ptr, exists, redirect), counted across nested includes. Exceeding this limit causes a permanent error (PermError) and SPF effectively stops working for your domain.
What's the difference between ~all and -all?
-all (hardfail) tells receivers to reject emails from unauthorized servers. ~all (softfail) marks them as suspicious but still delivers them. Use -all for maximum protection once you've confirmed all legitimate senders are included.
How does SPF relate to DMARC?
DMARC uses SPF (and DKIM) to authenticate emails. For DMARC to pass via SPF, the domain in the envelope From must align with the domain in the visible From header. Check your DMARC record alongside SPF.
Related tools
- DMARC checkerValidate your domain's DMARC record and see what to fix first.
- DKIM checkerLook up DKIM keys, with or without a selector.
- SPF record generatorBuild a valid SPF record with email provider presets.
- Create DMARC recordBuild a DMARC record with a live preview and publishing steps.
- Bulk DMARC & SPF lookupValidate DMARC and SPF records for up to 50 domains at once.
- What is SPF?How SPF authorizes the servers that send for you.