SPF Record Checker: Verify Your Domain's SPF in 30 Seconds

Your SPF (Sender Policy Framework) record tells the world which mail servers are allowed to send email on behalf of your domain. If it's missing, misconfigured, or too permissive, receiving mail servers may reject your email or flag it as spam.

An SPF record checker scans your domain's DNS for the SPF TXT record, validates the syntax, counts the DNS lookups (the limit is 10), and flags common mistakes like multiple SPF records, missing includes, or overly broad all mechanisms.

What an SPF Record Looks Like

A valid SPF record is a TXT record in your domain's DNS that starts with v=spf1. Here's a typical example:

v=spf1 include:_spf.google.com ~all

This says: "The SPF version is 1. Google's mail servers are allowed to send for this domain. Soft-fail everything else."

Common SPF Problems

1. No SPF record at all. This is the most common issue. If your domain has no SPF TXT record, receiving servers have no way to verify your sender. They may treat your email as suspicious.
2. Multiple SPF records. You should only have ONE SPF TXT record per domain. If you have two, the SPF check fails with a permerror, and some receivers will reject your email.
3. Too many DNS lookups. SPF has a hard limit of 10 DNS lookups. Each include, a, mx, or exists mechanism counts as one lookup. If you exceed 10, the check fails.
4. Missing includes. If you use a third-party service (like Mailchimp, SendGrid, or Salesforce) to send email, you need to include their SPF mechanism. For example, include:sendgrid.net for SendGrid.
5. Wrong all mechanism. The all mechanism at the end of your SPF record tells receivers what to do with mail that doesn't match any of the previous mechanisms. -all (hard fail) is the strictest and best for deliverability. ~all (soft fail) is more forgiving. +all (hard pass) is dangerous because it tells receivers that ANY server can send for your domain.

How to Check Your SPF Record

You can check your SPF record manually using dig or nslookup:

dig TXT yourdomain.com

Look for a TXT record that starts with v=spf1. If you don't see one, your domain has no SPF record.

But manual checking only tells you if the record exists. It doesn't validate the syntax, count the DNS lookups, or flag common mistakes. That's where a dedicated SPF checker comes in.

What a Good SPF Record Includes

• v=spf1 at the start (the SPF version)
• include: mechanisms for every third-party service you use to send email
• ip4: or ip6: for your own mail servers (if you host your own)
• -all at the end (hard fail, the strictest and best for deliverability)

SPF vs. DKIM vs. DMARC

SPF is one of three core email authentication protocols. The other two are DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting and Conformance). All three work together to prove that your email is legitimate.

• SPF tells receivers which IP addresses are allowed to send for your domain.
• DKIM adds a cryptographic signature to each email, proving it wasn't tampered with in transit.
• DMARC tells receivers what to do when SPF or DKIM fails, and gives you a report on who's sending as your domain.

A full deliverability audit checks all three, plus TLS, PTR, and IP reputation.