SPF Checker: Look Up and Validate Your SPF Record
Enter a domain to fetch its live SPF record. mailX flags a missing record, duplicate records and basic syntax errors, and explains how to fix each one.
Results
- Free SPF lookup
- Live DNS result
- No signup required
What does this SPF checker look at?
The problems that make SPF fail before a single email is checked.
Live SPF record
The TXT record starting with v=spf1 at the root of the domain, as receivers see it.
Missing record
No SPF record means receivers cannot tell which servers may send as your domain.
Multiple records
Two SPF records on one domain make SPF fail with a permanent error. The checker flags it.
Basic syntax
The record must start with v=spf1, list mechanisms such as include: or ip4:, and usually ends with an all qualifier or a redirect= modifier.
Valid record
When the record passes, you see it in full so you can check that every sender you use is in it.
Fix guidance
Each result links to a guide: create a record, merge duplicates or correct the syntax.
How to check and fix your SPF record
Five steps to an SPF record that passes for every sender.
Run the SPF lookup
Enter the domain used in your From address, or the return-path domain of your sending platform.
Read the record
Check that it starts with v=spf1 and ends with ~all or -all (or uses redirect=).
Compare with your senders
Every service that sends as this domain should be covered: mailbox provider, CRM, helpdesk, billing tool. Services that use their own return-path domain do not need an include.
Fix the problem found
No record: create one with the SPF generator. Several records: merge them into one. Syntax error: correct the mechanism or the qualifier.
Check again, then count lookups yourself
After publishing, run the check again. The checker does not count lookups: keep the record under 10 by removing includes you no longer need.
What is an SPF record?
SPF (Sender Policy Framework) is a TXT record that lists the servers allowed to send email for a domain. The receiving server looks up the SPF record of the return-path domain (the envelope sender, not always the visible From) and checks whether the sending IP is authorized.
A record is built from mechanisms and ends with an all qualifier. include: authorizes another provider's servers, ip4: and ip6: authorize addresses, a and mx authorize the domain's own hosts. -all fails anything not listed, ~all soft-fails it.
SPF has two hard limits: one record per domain, and no more than 10 DNS lookups to evaluate it. Every include, a, mx, ptr, exists and redirect counts, including those nested inside includes. Above the limit, SPF returns a permanent error.
A valid SPF record:
Mechanisms and qualifiers:
ip4:203.0.113.10 / ip6:...: authorize specific addresses
-all: fail everything else (hard fail)
~all: soft fail everything else
Related mailX tools
Fix SPF, then check the rest of your authentication.
SPF errors and how to fix them
These are the results the SPF checker returns, with the fix for each one.
No SPF record detected:
Multiple SPF records found:
Then delete the extra record
Invalid SPF syntax:
Remove typos such as spf1 without v=, or two all qualifiers
Other SPF problems to watch for
Issues that a valid-looking record can still hide.
Too many DNS lookups
A record that includes many providers can exceed 10 lookups once nested includes are counted. Remove includes you no longer use, and skip those not needed for DMARC.
Missing sender
A tool that sends as your domain but is not covered fails SPF. Add its include, or set up its own return-path domain.
Unneeded includes
Platforms such as SendGrid, Mailchimp or Postmark pass SPF on their own return-path. An include on your root domain only wastes lookups.
+all or ?all
+all authorizes every server on the internet, ?all says nothing. Use ~all or -all.
SPF passes but DMARC fails
SPF passed for the platform's return-path domain, not yours, so it is not aligned. Use DKIM with your domain or a custom return-path.
Forwarded email fails
Forwarding sends your message from another server, so SPF fails. DKIM survives forwarding: make sure it is set up.
SPF guides
Fix the errors this checker finds.
How to Fix SPF Errors
The most common SPF errors, from the 10 DNS lookup limit to syntax mistakes, and how to fix each one.
Multiple SPF Records: How to Find and Fix Them
Two SPF records on one domain make SPF fail. Here is how to merge them into one valid record.
9 SPF Record Examples
Ready-to-adapt SPF records for Google Workspace, Microsoft 365 and common sending platforms.
How to look up an SPF record from the command line
SPF lives in the TXT records of the domain. These commands list them all: look for the line starting with v=spf1, and make sure there is only one.
macOS and Linux (dig):
Windows (Command Prompt):
Windows (PowerShell):
Reading your SPF checker results
What each result means and what to do next.
Valid SPF record
The record exists and is well formed. Check that every service you send with is covered and that you stay under 10 lookups.
Multiple SPF records
SPF fails until you merge them into a single record.
No record or invalid syntax
Create or rewrite the record with the SPF generator, then check again.
SPF passes. Does DMARC?
SPF must align with your From domain for DMARC. Check SPF, DKIM and DMARC together in one free test.