SPF record checker

What this checks

SPF (RFC 7208) is a TXT record on your domain that starts with v=spf1 and lists the servers allowed to send mail as it. Enter a domain and the checker reads that record, then:

• checks there is exactly one v=spf1 record. Two or more is a permanent error, so SPF fails for every message;
• reads how it ends: -all (fail) and ~all (soft fail) protect the domain, ?all protects nothing and +all lets anyone send as you;
• counts the DNS lookups it needs, following every include: and redirect= the way receivers do, and shows the cost of each term. include, a, mx, ptr, exists and redirect cost one lookup each, plus whatever the included record needs; ip4, ip6 and all cost nothing;
• flags an include: of a name that has no SPF record, and the deprecated ptr mechanism.

Common problems and fixes

Too many DNS lookups. Over 10 is a permanent error (PermError) and SPF fails for all mail. Remove includes for services you no longer use, or replace one with its ip4: and ip6: ranges. The guide Fix "SPF too many DNS lookups" walks through it.

Two SPF records. Each new service tells you to "add a TXT record", so domains end up with two. Merge them into one, keeping every include:.

A new sender fails SPF. Add its include to the existing record. The SPF record builder writes the record from a list of services and compares it with the one you publish now.

SPF alone does not stop spoofing of the address people see in the From line: that needs DMARC. Check it with the DMARC checker, or run every check at once with the email security check. If mail is still landing in spam, start with Why is my email going to spam?.

FAQ