Free SPF Record Checker

SPF (Sender Policy Framework) specifies which mail servers are allowed to send email for your domain.

-all (fail) is the strictest: only listed senders are allowed. ~all (softfail) is more lenient.

Yes, completely free.

Absolutely. The SPF Record Checker processes everything client-side in your browser. No data is uploaded to or stored on any server. Your content remains private on your device at all times.

Yes, the SPF Record Checker is fully responsive and works on smartphones and tablets. You can use it on any device with a modern web browser -- no app download required.

No account or registration is needed. Simply open the SPF Record Checker in your browser and start using it immediately. There are no sign-up walls or usage restrictions.

Simply enter your input in the provided field, adjust any settings to your preference, and the tool will process it instantly. You can then copy the result to your clipboard or download it.

The SPF Record Checker works in all modern browsers including Chrome, Firefox, Safari, Edge, and Opera. For the best experience, use the latest version of your preferred browser.

The SPF specification (RFC 7208) requires exactly one record beginning with v=spf1 per domain. When a receiving mail server finds two or more, the result is a PermError, and many servers stop evaluating SPF entirely — so legitimate mail can be marked as spam or rejected even though each record looks valid on its own. This is one of the most common SPF mistakes, usually caused by adding a second record for a new email provider instead of merging into the existing one. The fix is to combine all your include and ip4 mechanisms into a single v=spf1 line. This checker scans every TXT record for the domain and raises a clear red warning the moment it detects more than one SPF record, so you can spot the conflict before it breaks delivery.

Both sit at the end of the record and set the default policy for senders that do not match any earlier mechanism. The qualifier -all is a hard fail: any unlisted server is rejected outright, which is the strictest and recommended setting once you are confident every legitimate sender is included. The qualifier ~all is a softfail: unlisted mail is accepted but flagged as suspicious, which is the safer choice while you are still testing and do not want to lose real messages. A record ending in +all authorizes every server on the internet and defeats the purpose of SPF entirely. This tool reads your trailing all mechanism, labels it Pass, Neutral, or Fail, and tells you plainly whether you have the strict, lenient, or insecure policy.

SPF caps the number of DNS-querying mechanisms at 10. Every include, a, mx, ptr, exists, and redirect term triggers a lookup, and nested includes count too — so an include that itself contains three includes uses several of your budget. Exceed 10 and receivers return a PermError, which causes SPF to fail and can send your mail to spam. Big providers like Google Workspace and Microsoft 365 each consume multiple lookups through their own nested includes, so records bloat quickly when you stack several services. While this checker does not recursively resolve every nested include, its summary panel counts your direct include directives and explicit ip4/ip6 ranges, giving you a fast read on whether your record is getting dangerously crowded so you can flatten it before it hits the limit.

When you enter a domain, the tool queries Cloudflare's public DNS-over-HTTPS resolver for that domain's TXT records, then filters for the one starting with v=spf1. This is live data pulled straight from public DNS at the moment you click Check, not a cached or stored copy, so it reflects your record exactly as the rest of the internet sees it right now. Because it reads authoritative DNS, results may lag a freshly published change until your old record's TTL expires and caches refresh. Only the domain name you type is sent to that public resolver — the same information any DNS lookup involves — and no credentials or private content are ever requested. Enter your domain or try a built-in example like google.com or github.com to see a real, well-formed SPF record parsed instantly.

The include mechanism imports another domain's entire SPF policy into yours, authorizing all the servers that domain permits. It is how you let a third-party service send mail as you: include:_spf.google.com adds Google Workspace's mail servers, and include:spf.protection.outlook.com adds Microsoft 365. This keeps your record short and lets providers update their own sending IPs without you editing your DNS. The catch is that each include counts toward SPF's 10-lookup limit and pulls in whatever that provider publishes, including their nested includes. When you run a lookup here, every include term appears in the parsed results table with its target domain spelled out, and the analysis panel tallies how many include directives you have — making it easy to see which services you have authorized and whether the list has grown too long.