SPF Checker - Lookup, Validate & Test Your SPF Record
include and redirect, and runs 14 automated validation tests against your record. It breaks down each mechanism and qualifier, counts every DNS lookup, and flags syntax errors before receiving servers do. No signup required.Enter your domain to run a full SPF lookup and security review
What This SPF Checker Tests
v=spf1, that every mechanism is one SPF actually defines, that ip4 and ip6 values parse as real CIDR ranges, and that nothing trails after all, where it would be silently ignored. Another group walks your DNS lookup budget, counting every include, a, mx, exists and redirect - including the ones buried inside records you do not control - against the limit of ten, and counting void lookups separately because those carry their own cap.ptr mechanism and scopes broad enough to authorize the whole internet. Every result arrives with the nested lookup tree beside it, and each branch carries its own lookup count, so when something fails you can see which include is responsible instead of guessing.SPF Record Syntax Explained
v=spf1 include:_spf.google.com ip4:203.0.113.5 -all | | | | | | | └─ qualifier + all: fail everything else | | └─ mechanism: one specific IP address | └─ mechanism: import Google's authorized senders └─ version: always first, always exactly this
all matches everything, it has to come last - anything after it is unreachable, which is why this checker treats trailing terms as an error rather than a style problem.Mechanisms: What You Can Authorize
Mechanisms are the terms that describe a sender. The DNS cost column is the one that decides whether your record survives: only ten lookups are available across the whole evaluation, nested records included, and five of these mechanisms spend one each every time they appear.
| Mechanism | Matches when | DNS cost |
|---|---|---|
all | Always. Placed last as the catch-all for every unlisted sender. | None |
ip4 | The connecting IP is the given IPv4 address or inside the given range. | None |
ip6 | The connecting IP is the given IPv6 address or inside the given range. | None |
a | The connecting IP matches the domain's A or AAAA record. | 1 lookup |
mx | The connecting IP is one of the domain's MX hosts. | 1 lookup. The per-host queries it triggers are capped separately. |
include | Another domain's SPF record returns a pass. Imports their senders, not their policy. | 1 lookup, plus every lookup inside that record |
exists | The given domain resolves at all. Used with macros for per-sender checks. | 1 lookup |
ptr | The connecting IP's reverse DNS resolves back into the domain. Deprecated - remove it. | 1 lookup. The per-name queries it triggers are capped separately. |
redirect= hands evaluation entirely to another domain's record, which is useful when several domains share one policy. It is ignored outright if the record also contains an allmechanism, so the two should never appear together. exp= names a domain holding a TXT record with the explanation receivers may quote back on a failure. Unlike mechanisms, modifiers may appear anywhere and at most once each.Qualifiers: How Strict the Policy Is
+, which is why include:_spf.google.com and +include:_spf.google.com are the same instruction. In practice the qualifier that matters is the one on all, because it governs every sender you did not list.| Qualifier | Result | What receivers typically do |
|---|---|---|
+ | Pass | Accept. The default when no qualifier is written. |
- | Fail | Reject outright. The strict choice for a complete sender list. |
~ | SoftFail | Accept but mark as suspicious. The safe choice while auditing. |
? | Neutral | Treat as though no policy existed. Offers no protection. |
The Syntax Rules That Actually Break Records
v=spf1 record, and two of them is a permanent error rather than a merge; this is the usual state of a domain a month after changing email provider. A single character string inside the TXT record cannot exceed 255 bytes, so longer records must be split into several quoted strings which DNS concatenates - your provider's interface may or may not do this for you. Mechanism names are case-insensitive but must be spelled exactly, and inlcude is the typo that costs people the most time. Finally, ptr is deprecated by RFC 7208 and some receivers ignore it outright, so it should be removed rather than corrected.Common SPF Errors and How to Fix Them
permerror, which fails authentication and can drag DMARC down with it. Remove includes for services you have stopped using, replace an include with direct ip4 ranges where your provider publishes stable ones, and consolidate senders onto fewer platforms. The lookup tree above shows the count per branch, so start with whichever include is spending the most.v=spf1 record does not combine the two - it invalidates both, and every message fails. Merge the mechanisms into one record and delete the other. Syntax typos. A misspelled mechanism, a missing v=spf1 prefix or stray text after all makes receivers skip the record entirely, with no bounce and no warning, which is the argument for re-checking after every DNS edit rather than only when mail starts failing.+all authorizes every sender on the internet and is worse than having no record, since it tells receivers your domain vouches for spoofed mail; ?all is neutral and achieves nothing. Use ~all while you are still discovering which services send on your behalf, and -all once you are confident the list is complete, or immediately on a domain that sends no mail at all. After publishing any fix, run the domain through this page again: DNS edits usually propagate within the hour but can take up to 48 hours to be visible everywhere.Frequently Asked Questions
Enter your domain in the checker above and run the lookup. The tool performs a live SPF record lookup against your DNS, displays the record, builds the nested lookup tree for every include and redirect, and runs 14 validation tests covering syntax, lookup count, include health, and risky mechanisms.
A valid record is a single TXT record that starts with v=spf1, lists authorized senders in the middle, and ends with an all qualifier, for example:
v=spf1 include:_spf.google.com ip4:203.0.113.5 -allThis authorizes Google's sending servers and one IP address, and tells receivers to fail everything else.
Yes, SPF enforces a hard limit of 10 nested DNS lookups. include:, a:, mx:, and redirect= each count as one lookup, and lookups inside included records count toward your total. Exceeding the limit returns a permanent error (permerror), which fails authentication and can trigger DMARC failures. Organizations using multiple email services hit this limit more often than any other SPF issue; the checker's lookup counter shows exactly where your budget goes.
These qualifiers define how strict your policy is.
-allfails all unauthorized senders (recommended for strict policies).~allis a soft fail. Suspicious mail is marked but usually delivered.?allis neutral and offers no protection.+allpasses everything, which defeats SPF's purpose entirely. Never use it.
SPF breaks on forwarded email, because the forwarding server becomes the new sender and fails the check against your domain. It also only protects the envelope sender, not the “From” header users actually see. That's why SPF works best alongside DKIM for message integrity and DMARC for policy enforcement and reporting. After fixing your SPF record, run your domain through the DMARC Checker to verify the full authentication chain.
Yes. Run dig +short TXT yourdomain.com (macOS/Linux) or nslookup -type=TXT yourdomain.com (Windows) and look for the record starting with v=spf1. The command line shows you the raw record, but it won't count nested DNS lookups, expand includes, or validate syntax - that's what this checker adds on top of the lookup.
Flattening replaces include mechanisms with the IP addresses they resolve to, cutting DNS lookups to stay under the 10-lookup limit. The risk: providers change their sending IPs without notice, so a flattened record goes stale silently and legitimate mail starts failing. Before flattening, remove unused includes and use direct ip4 ranges only where your provider publishes stable ones. If you do flatten, re-check the record on a schedule - this page shows your live lookup count each time.