Log in
Checker

SPF record checker

Check a domain's SPF record: valid syntax, number of DNS lookups (10 at most), overly broad networks and all included records as a tree.

What the SPF checker checks

SPF (Sender Policy Framework) uses DNS to define which servers may send email for a domain. The checker reads the record, follows every include: and redirect= reference and shows typical mistakes:

  • More than 10 DNS lookups: SPF is then invalid (permerror), even if the record looks correct. Every include, a, mx and exists counts – including in included records.
  • Multiple SPF records on the same domain also make SPF invalid.
  • +all or ?all: allows every server or doesn't rate unknown servers.
  • Very large networks such as ip4:10.0.0.0/8 allow far too many senders.

Learn more: SPF, DKIM and DMARC explained · Build a new record: SPF generator

FAQ

How do I check my SPF record?

Enter your domain. We read the SPF record, resolve all included records, count the DNS lookups and show errors such as duplicate records or overly broad networks.

What does SPF permerror mean?

The record is invalid, usually because of more than 10 DNS lookups, multiple SPF records or a typo. Mailbox providers then treat the email as if there were no SPF.

Is SPF alone enough?

No. SPF only checks the server, not the visible From address, and is lost when email is forwarded. Only with DKIM and DMARC is your domain effectively protected.