SPF Record Checker
Fetch and parse SPF records for a domain to validate email security.
Quick answer
Enter a domain to fetch and parse its SPF TXT record: mechanisms, includes, and the all qualifier. Pair with DKIM/DMARC and the trust email validator for a full email-auth picture.
Fetches TXT records and parses SPF — runs on our server.
About this tool
SPF (Sender Policy Framework) lists which hosts may send mail for a domain. This checker reads DNS TXT and explains common misconfigurations — it does not send mail or prove a mailbox exists.
How to use
- Enter the apex domain (example.com), not a full email address.
- Review mechanisms (include, ip4, a, mx) and the trailing all qualifier (~all vs -all).
- If lookup count exceeds 10, flatten includes or move senders into fewer records, then re-check with DKIM and DMARC.
Common use cases
- Onboarding a new ESP (Google, Microsoft, SendGrid) and confirming SPF published.
- Debugging softfail/fail results before tightening DMARC policy.
- Pre-launch email deliverability review alongside DKIM and DMARC.
Example inputs
example.comgmail.comCommon issues and fixes
No SPF record
Domain has no SPF TXT record — email may fail DMARC or be marked as spam.
Too many DNS lookups
SPF allows max 10 DNS lookups. Flatten include chains or reduce nested includes.
Hard fail with typos
~all (softfail) is safer than -all during migration. A typo in a mechanism can hard-fail legitimate senders.
Recommended remediation
Publish a single v=spf1 TXT at the apex. Example: v=spf1 include:_spf.google.com ~all. Flatten if you exceed 10 DNS lookups. Also check DKIM selectors and _dmarc policy.
Pro tips
- Never publish multiple conflicting SPF TXT records on the same name.
- Use ~all while migrating; move to -all only after DMARC reports look clean.
- After SPF, open the free Email Validator for format + disposable risk: /tools/email-validator.
FAQ
How do I check SPF for a domain?
Enter the domain above. We fetch TXT records, find v=spf1, and summarize mechanisms plus the all qualifier.
What does the SPF 10 DNS lookup limit mean?
Each include/a/mx/redirect that triggers extra DNS counts toward a hard limit of 10. Exceeding it makes SPF fail evaluation — flatten includes or reduce providers.
Is SPF enough for email authentication?
No. Use SPF with DKIM and DMARC. SPF alone does not prove content integrity or mailbox existence.
Should I also validate email addresses?
Yes for lead quality: use /tools/email-validator for format, disposable risk, and MX — separate from SPF policy checks.
Related security tools
DNS Lookup
Query DNS records (A, AAAA, MX, TXT, NS, CNAME) for any domain using public DNS API.
DKIM Record Checker
Verify DKIM DNS records. Domain + selector → TXT lookup and parse.
DMARC Record Checker
Verify DMARC DNS records. Policy, RUA, RUF, alignment.
MX Record Lookup
Check mail server (MX) records. Priority order.
Email Validator
Validate email format and check MX records. Verify if domain accepts mail.
Run a full security check
After this tool passes, run related header and policy checks to catch transport and browser-level risks.