SPF checker

What this SPF checker validates

SPF (Sender Policy Framework) is a TXT record that lists which servers may send mail for your domain. Receiving servers check the connecting IP against that list. The record looks like this:

v=spf1 include:_spf.google.com include:servers.mcsv.net ip4:203.0.113.5 ~all

That example authorizes Google Workspace, Mailchimp, and one dedicated IP, then tells receivers to soft-fail everything else. Four things decide whether a record like this works, and the checker tests each one.

One record, valid syntax. The checker parses every mechanism — ip4, ip6, include, a, mx, exists, redirect, all — and flags anything a receiver would not recognize. It also counts how many v=spf1 records the domain publishes, because two records is an automatic permerror under RFC 7208 §3.2. This happens more than you would expect: a company adds a second ESP, pastes the vendor's suggested record next to the existing one, and authentication quietly breaks for both.

The 10-DNS-lookup limit. Each include, a, mx, exists and redirect costs one DNS query, and the includes you pull in bring their own. include:_spf.google.com alone expands to three nested lookups. Stack four or five vendor includes and you can cross ten without writing a single long record yourself. Past the limit, receivers stop evaluating and return permerror — your SPF fails even though every individual mechanism is correct. This checker resolves the whole include tree recursively and shows you the count, so you can see exactly which vendor pushed you over.

The all qualifier. The final mechanism decides what happens to senders not on the list. -all is a hard fail, ~all a soft fail, ?all neutral. +all approves everyone — a spammer's favorite misconfiguration, and the checker flags it as critical.

Includes that resolve. An include pointing at a domain with no SPF record of its own is another permerror. Vendors occasionally rename their SPF hosts; records referencing the old name keep failing until someone notices.

How to read your result

A green pass means the record parses, stays within ten lookups, resolves every include, and ends with a meaningful policy. Warnings are worth fixing but not urgent: a lookup count of eight or nine, a ?all policy, a deprecated ptr mechanism. Errors mean receivers are already treating your SPF as broken — a missing record, duplicate records, an unresolvable include, or a lookup count past ten.

The include tree below the verdict shows every domain the checker followed and whether it published SPF. Depth matters here. If include:mail.example-vendor.com itself includes three more domains, all of them count against your budget, not the vendor's.

Common fixes

• Over 10 lookups: drop includes for services you no longer use, or replace a vendor include with its published ip4 ranges. Re-check after every edit — vendors change ranges.
• Multiple records: merge them. Take the mechanisms from the second record, append them to the first before the all term, delete the second.
• +all or ?all: switch to ~all, watch your DMARC reports for a few weeks, then move to -all once nothing legitimate fails.
• A vendor missing from the record: add the include your provider documents in its DNS setup guide, or build the record from scratch with our SPF generator.

What SPF alone cannot tell you

SPF verifies the sending server, not the message. It breaks on forwarding, it says nothing about content, and by itself it does not stop someone spoofing your display name. It also does not measure where your mail actually lands. A domain with flawless SPF can still hit the spam folder at Gmail — sender reputation and list quality weigh more than any DNS record. Treat this check as a configuration audit. For placement numbers, we run seed-list tests against real mailboxes and publish the results in our deliverability rankings, with the full protocol on the methodology page.

Once SPF is clean, verify the other two legs of authentication: run your domain through the DKIM checker and the DMARC checker, or check all of them at once with the email authentication checker.

Frequently asked questions