Free tool
SPF checker
Enter a domain to read its SPF record, follow every include and count the DNS lookups against the limit of ten that receivers enforce. No account needed. The domain is looked up in public DNS and is not stored.
SPF checker
How to read the result
What this checker measures
SPF lists the servers allowed to send for a domain. A receiver checks it against the envelope sender, not the From line you see.
Lookups
The real total, following every include the way a receiver does. A count taken from the record alone misses most of them, because the expensive part sits inside the includes.
Void lookups
Terms that point at names with no answer. Each one is a leftover worth deleting, and more than two can fail SPF at some receivers.
Syntax
Every term, what it does, and whether it is safe. The same parser runs in the generator, so the two tools never disagree about a term.
SPF alone does not protect your From line. Pair it with DKIM and a DMARC policy. Starting from nothing? Generate the records first.
FAQ
Questions about SPF
What is the SPF lookup limit?
Ten. Evaluating a record may take at most ten DNS lookups, counting include, a, mx, ptr, exists and redirect, and counting the ones inside every include. Past ten, receivers return a permanent error and SPF fails for all your mail. ip4 and ip6 cost nothing.
How do I fix too many SPF lookups?
Remove senders you no longer use first, because old includes are the usual cause. Then move a sender onto its own subdomain, such as mail.example.com, which has its own record and its own count of ten. Copying a provider's IP addresses into your record, known as flattening, lowers the count but breaks without warning when the provider changes them.
What is a void lookup?
A lookup that answers with nothing, because the name does not exist or has no record of that type. RFC 7208 recommends a limit of two, and some receivers enforce it. They usually come from an include or an a: term left behind after a provider or a server went away.
Should SPF end in -all or ~all?
Either is fine once DMARC is in place, because DMARC decides what happens to failing mail. ~all is the safer start while you confirm your senders, and -all is the firm answer. +all is never right: it authorizes every server on the internet.
Can a domain have two SPF records?
No. A name may publish one, and two is a permanent error at the receiver. Merge them into a single record with the terms from both.
Free tools
Related tools
DMARC checker
Look up a domain's DMARC record, see which policy really applies to it, and get the record to publish next.
Open the toolDKIM checker
Fetch a DKIM public key by domain and selector, and check its format, length and whether it has been revoked.
Open the toolSPF and DMARC record generator
Build the SPF and DMARC records for a new sending domain or subdomain, or check the ones you already publish, and see what each setting means.
Open the tool
Next step
Send from a subdomain with its SPF already right
Add a sending domain and SendRaven gives you the exact records to publish, with transactional and marketing mail on separate identities.