SPF Checker
Audit the SPF record that authorises senders.
Use the SPF Checker tool
What this spf checker does
SPF lists the servers allowed to send mail for a domain. Receivers compare the sending server's address with that list and record a pass, softfail, neutral or fail result. The record is a single TXT record beginning with `v=spf1`.
This checker reads the record and audits the parts that commonly go wrong: more than one SPF record, a `+all` that authorises everyone, a missing `all`, and too many lookup-producing mechanisms. SPF allows at most ten DNS lookups per check, including nested includes.
Why use it
- Confirm that your mail provider's include is present.
- Catch a second SPF record that breaks the policy.
- See how close the policy is to the ten-lookup limit.
How to use it
- 1Enter the domain whose mail you send from.
- 2Run the check.
- 3Review each finding and the raw record before editing DNS.
Worked examples
Provider include
Input
v=spf1 include:_spf.google.com -all
Output
One include, a hard fail for everything else, one lookup-producing mechanism.
Permissive mistake
Input
v=spf1 +all
Output
Warning: +all authorises every server on the internet.
Common mistakes
- Publishing two SPF records instead of merging the mechanisms into one.
- Using ~all and assuming failing mail is blocked; softfail is often accepted.
- Chaining many includes and exceeding the ten-lookup limit, which yields a permanent error.
Frequently asked questions
Does SPF check the From header?
SPF authenticates the envelope sender (the bounce address), not the visible From header. DMARC alignment connects the two.
Can SPF survive forwarding?
Often not, because forwarding changes the sending path. DMARC reporting helps you see when this happens.
Should I use -all or ~all?
-all is stricter once you are confident the list is complete. Start with ~all while monitoring, then tighten.