SPF record checker
SPF checker: read a domain’s SPF record, list its mechanisms and count the DNS lookups against the limit of 10.
Queries go to Cloudflare’s public DNS over HTTPS service when you press the button. Up to 15 queries are made to follow include records.
About the spf record checker
SPF checker: read a domain’s SPF record, list its mechanisms and count the DNS lookups against the limit of 10.
Part of SmartCalcy’s data & networking tools. It runs in your browser with no account, uses your own currency and units (change them at the top of the page), and gives estimates for information only, so check official guidance before you rely on a result.
How to use the spf record checker
What it calculates and when to use it
Reads a domain’s SPF record, the list of servers allowed to send email for it, and checks it for common faults: more than one record, a missing “all” policy, and more than 10 DNS lookups, which makes SPF fail. It follows include records to count the lookups.
How to use it, step by step
- Enter the domain, for example example.com.
- Press “Check SPF”.
- Read the verdict and the number of DNS lookups used out of 10.
- Review the mechanisms list and any warnings.
What each input means
- Domain name – The domain used in the sender’s address.
How to read the results
- Verdict – Looks valid, or Needs attention when a problem is found.
- Policy – What happens to mail from servers that are not listed: hard fail, soft fail, neutral or allow.
- DNS lookups – Lookups needed by include, a, mx, ptr, exists and redirect terms, compared with the limit of 10.
- Mechanisms – Every term in the record, with included records indented beneath their parent.
The formula
The record is the TXT value starting v=spf1. Each include, a, mx, ptr, exists or redirect term costs one DNS lookup, and included records add their own. ip4 and ip6 terms and “all” cost none. The RFC limit is 10 lookups.
A worked example
v=spf1 include:_spf.example.net a mx -all uses three lookups for its own terms plus those inside the included record, and ends in -all, so unlisted servers are rejected.
Assumptions and limits
- At most 15 queries are made while following includes, and nesting stops after 5 levels.
- A domain may need a record only for mail it sends. Domains that send no mail should publish v=spf1 -all.
- The check does not test whether a particular server would pass.
Common mistakes
- Publishing two SPF records. Only one is allowed, so merge them into one.
- Ending with +all, which lets anyone send as your domain.
- Adding every email service as an include and passing 10 lookups, which turns SPF into a permanent error.
Frequently asked questions
What is SPF?
Sender Policy Framework is a DNS record that lists the servers allowed to send email for a domain.
What is the difference between -all and ~all?
-all asks receivers to reject unlisted senders. ~all asks them to accept but mark the mail as suspicious.
Why is there a limit of 10 lookups?
It stops a record from forcing receivers into long chains of DNS queries. Going over it makes SPF return a permanent error.
Is SPF enough to stop spoofing?
No. Use it with DKIM and DMARC.
Does this tool send email?
No. It only reads DNS records.