Free tools / SPF Checker
SPF record checker
SPF is the DNS record that lists which servers may send email for your domain. Receivers check it on every message. A missing, duplicated or over-long record makes legitimate mail fail authentication, and an open record lets spammers send as you. This checker pulls the record, parses each mechanism and lists the specific problems.
The most common failure we see is the ten-lookup limit. Every include adds lookups, and a domain that has bolted on a CRM, a helpdesk, a newsletter tool and a payroll system often crosses ten without anyone noticing. At that point strict receivers return permerror and the record is worth nothing.
What you get back
The record. The full SPF string as published, so you can see exactly what receivers see.
Mechanisms. Each include, ip4, ip6, a and mx term listed out.
All policy. Whether the record ends in -all (strict), ~all (softfail), ?all (neutral) or the dangerous +all.
DNS lookup count and issues. How close you are to the limit of ten, plus every other problem found.
How to use it
- Enter the sending domain.
- Press Check SPF.
- Fix each issue in order. Multiple records must be merged into one. Over ten lookups means flattening includes or removing unused senders. +all must become ~all or -all.
Who uses this
Anyone setting up a new sending domain. Gmail and Yahoo now require SPF or DKIM alignment for bulk senders. A bad SPF record is the first thing to rule out.
Cold email operators. Secondary sending domains are set up fast and often wrong. A checker in the setup checklist prevents a burned domain.
IT teams after adding a SaaS tool. Each new include can push the record over the lookup limit. Check after every change.
Same check, in your code
One API key, one credit pool, 1,000 free lookups to start. Phone, email, IP and DNS checks from a single endpoint, and you only pay for lookups that return an answer.
Start free Read the docsQuestions
Why does the check count lookups?
RFC 7208 caps SPF evaluation at ten DNS lookups. Include, a, mx, ptr, exists and redirect each count. Past ten, receivers return permerror and treat the record as failed.
Should I use ~all or -all?
Use -all once you are sure every legitimate sender is listed. Use ~all while you are still discovering senders. Never leave +all.
I have two SPF records. Which one wins?
Neither. Two records is a permanent error under the spec. Merge them into a single v=spf1 record.
Does SPF alone satisfy Gmail's bulk sender rules?
SPF or DKIM alignment plus a DMARC record is the minimum. Set up all three.