SPF Record Checker: Free Online SPF Lookup

An SPF record checker looks up the SPF record published in a domain's DNS and breaks it into readable parts. Enter a domain name, and this free tool shows the raw record, a table of every mechanism and qualifier, and warnings about common problems, so you can verify your email authentication setup in seconds.

What Is an SPF Record?

An SPF record is a DNS TXT record that lists the servers allowed to send email for a domain. SPF stands for Sender Policy Framework and is defined in RFC 7208. When a receiving mail server gets a message, it looks up the SPF record for the sender's domain and checks whether the connecting server's IP address is on the list.

Every SPF record starts with v=spf1, followed by one or more mechanisms, and it usually ends with an all mechanism. Each mechanism can carry a one-character qualifier that tells receivers what to do when it matches. If you leave the qualifier off, it defaults to plus (pass).

Common SPF mechanisms

• ip4 and ip6 authorize a specific IPv4 or IPv6 address or range.
• a and mx authorize the addresses in the domain's own A/AAAA or MX records.
• include pulls in another domain's SPF policy, which is how most email providers are added.
• redirect hands the whole decision to another domain's SPF record.
• exists and ptr are rarer; ptr is deprecated and best avoided.
• exp supplies an explanation string for failures.

How to Use the SPF Record Checker

You can check any domain in a few clicks, and you do not need an account. Follow these steps:

1. Type the domain into the Domain Name field, for example example.com. If you paste a full address that starts with https://, the tool trims it down to the domain.
2. Click Check SPF Record. The button changes to Checking... while the lookup runs.
3. Read the status banner: SPF Record Found with either No local syntax warnings or Issues Detected, or No SPF Record Found.
4. Review the Raw SPF Record box to see exactly what is published.
5. Scan the Parsed Mechanisms table. Its columns are Mechanism, Qualifier, Value and Description.
6. Read any warnings listed under the table, fix the record at your DNS host, and run the check again.

Worked Example: Reading a Typical SPF Record

Say you enter example.com and the tool returns this raw record: v=spf1 ip4:203.0.113.10 include:_spf.google.com include:sendgrid.net ~all.

The Parsed Mechanisms table lists four rows. The first is ip4 with a plus qualifier and the value 203.0.113.10, described as an authorized IPv4 address or range. The next two are include rows for _spf.google.com and sendgrid.net, each described as including another domain's SPF policy. The last row is all with a tilde qualifier, described as matching all senders.

In plain language: your own server at 203.0.113.10, Google's mail servers and SendGrid may send as example.com, and everyone else gets a SoftFail. The banner shows No local syntax warnings because the record has an all mechanism and fewer than 10 includes.

Now compare a weaker record: v=spf1 include:_spf.google.com. The table shows one include row, and the tool warns that no all mechanism or redirect modifier was found. Without a closing all, senders that match nothing get a Neutral result, so spoofed mail is not clearly marked as unauthorized.

How Do You Read and Act on the Results?

The banner, the table and the warnings each tell you something different, and each has a clear next step.

Status banner

SPF Record Found with No local syntax warnings means the record was published and none of the checks this tool runs raised a flag. Issues Detected means at least one warning appeared below the table. No SPF Record Found means the domain has no TXT record beginning with v=spf1, so you should publish one.

The all mechanism

A trailing -all is a hard fail and the strictest policy. A trailing ~all is a SoftFail and is a common starting point while you confirm that every legitimate sender is listed. A trailing ?all is Neutral and offers little protection. A +all authorizes every sender on the internet, which defeats the purpose of SPF, so change it right away if you see it.

Warnings the tool can raise

• Too many include mechanisms: shown when the record has more than 10 includes. Remove providers you no longer use or replace includes with ip4 ranges.
• No all mechanism or redirect modifier: add a closing ~all or -all, or a redirect to a domain that holds the real policy.
• An all mechanism overrides redirect: when both appear, the redirect is never evaluated. Delete whichever one you do not need.

Unknown mechanism rows

If the Description column says Unknown mechanism, the term is not one SPF defines. This is usually a typo such as inlcude, or a stray word pasted into the record. Correct the spelling at your DNS host.

When Should You Check an SPF Record?

Check your SPF record any time your sending setup changes or your mail behaves oddly. These are the most common situations:

• After adding a sender: you connected a newsletter platform, CRM or help desk and need to confirm its include is published.
• After a DNS change: you edited the TXT record at your registrar or DNS host and want to confirm what is now live.
• When mail lands in spam: a missing or overly loose SPF record is one of the first things to rule out.
• Before launching a domain: a new domain should publish SPF before it sends any email.
• During a security review: you are auditing a domain you manage, or one you are about to take over, for spoofing risk.
• Checking a parked domain: a domain that never sends mail can still publish v=spf1 -all to say no server is allowed.

Best Practices and Common Mistakes

Most SPF problems come from a small set of repeatable mistakes, and they are easy to avoid once you know them.

Keep one SPF record per domain

A domain should publish a single TXT record that starts with v=spf1. Two separate SPF records cause a permanent error under RFC 7208. If you need to add a provider, merge its include into your existing record instead of creating a second one. This tool shows the first SPF record it finds, so it will not tell you a duplicate exists. Check your DNS zone for extra v=spf1 entries if mail still fails.

Watch the 10 DNS lookup limit

SPF allows at most 10 DNS lookups per evaluation. The include, a, mx, ptr, exists and redirect terms count toward that limit, while ip4, ip6 and all do not. Each include can also trigger further lookups inside the provider's own record, so a record with only six includes can still go over. Swapping a rarely changed include for an ip4 range is a common way to save lookups.

Start soft, then tighten

If you are not sure every sender is listed, publish ~all first, review your mail for a few weeks, then move to -all once nothing legitimate is failing.

Fix the domain you actually send from

SPF is checked against the domain in the envelope sender, which is often a subdomain or a provider's bounce domain. If you send from mail.example.com, check that exact name, not only the root domain.

Troubleshooting a surprising result

• No SPF Record Found, but you just added one: DNS caches keep old answers until the record's TTL expires. Wait and check again.
• Invalid domain message: enter a name like example.com with no spaces, and include the dot and extension.
• NXDOMAIN message: the name does not exist in DNS. Check for typos or an unregistered domain.
• DNS lookup unavailable: the lookup could not be completed. Try again in a moment.
• Record looks cut off: long records are often stored as several quoted strings. They are joined into one line, so the displayed record should read as a single value.

You can cross-check from a terminal with nslookup -type=txt example.com or dig TXT example.com. The output should match the Raw SPF Record box once caches have refreshed.

What Does This SPF Checker Not Evaluate?

This tool inspects the published record only. It does not follow include or redirect targets, and it does not count the total recursive DNS lookups, so a record can show No local syntax warnings and still exceed the 10-lookup limit once all nested includes are expanded. It also does not test whether a specific IP address would pass or fail.

Treat the result as a fast first check of structure and policy. For a real message, open its headers in the email header analyzer to see whether SPF actually passed.

Next Steps After Checking SPF

SPF is one part of email authentication. A matching DKIM signature lets receivers verify that a message was not altered, so run your selector through the DKIM record checker as well. If your mail still struggles to reach inboxes, see whether your sending IP or domain is listed with the blacklist checker.

Enter your domain in the Domain Name field above and click Check SPF Record to see your parsed mechanisms and warnings right now. For more domain and server safeguards, browse the security and encryption tools.