Prontuno
Pricing
AI

Appearance

Log in Request access
Tools

ToolsEmail authentication

Free SPF record checker and lookup counter

An SPF record lists the servers allowed to send email for a domain. It is published as a TXT record at the domain itself. Enter your domain below to see the record, the mechanisms that authorize senders, any syntax errors, and your DNS lookup count against the limit of 10.

Background

What is an SPF record?

An SPF record is a DNS TXT record that lists the servers allowed to send email for a domain. Receiving servers compare the connecting IP address with the SPF record of the envelope sender’s domain, then return pass, fail, softfail, or neutral based on the record’s mechanisms and qualifiers.

How to read the result

Receivers read the mechanisms from left to right and stop at the first one that matches the sending IP. The all mechanism at the end sets the result for every sender that did not match earlier.

A policy can be valid and still authorize the wrong systems. Compare every include and IP range with the services that actually send mail for the domain.

The lookup count is the number of DNS queries your SPF record triggers, including queries made by nested include statements. Receivers stop evaluating an SPF record once it goes past 10 lookups, which causes SPF to fail.

Coverage

What this tool checks

  • Whether the domain publishes an SPF record, and whether it publishes more than one
  • The SPF version and record syntax
  • Mechanisms such as include, ip4, ip6, a, mx, and exists
  • The qualifier on each mechanism: pass, fail, softfail, or neutral
  • DNS lookups used by the policy and its includes, against the limit of 10

Step by step

How to check your SPF record

  1. Enter your domain in the form above, then select Check SPF.

  2. Read the lookup count and any warnings.

  3. Fix each warning by removing unused include statements or consolidating senders into one SPF record.

Reference

SPF mechanisms and modifiers

Term What it matches DNS lookup
include: Senders authorized by another domain’s SPF record. Yes
a The domain’s A and AAAA addresses. Yes
mx The addresses of the domain’s MX servers. Yes
ip4: and ip6: An IP address or range. No
exists: Any sender, if the given domain has an A record. Yes
ptr Senders by reverse DNS. Deprecated, so avoid it. Yes
redirect= Uses another domain’s policy instead of this one. Yes
all Every sender. Place it last. No

Reference

SPF qualifiers

Qualifier Result Typical use
+ Pass The default when no qualifier is written.
- Fail Reject unlisted senders, as in -all.
~ Softfail Accept but mark unlisted senders, as in ~all.
? Neutral Make no assertion about the sender.

Troubleshooting

Common problems and how to fix them

No SPF record
Publish one TXT record at the domain that starts with v=spf1 and lists only the systems allowed to send for it.
Multiple SPF records
Merge every authorized source into a single record. When a domain publishes two SPF records, receivers return a permanent error.
Too many DNS lookups
Remove includes for services that no longer send for the domain. Replace a and mx mechanisms with fixed IP ranges where the addresses are stable.
Missing all mechanism
Add ~all or -all at the end once every sender is listed. Without it, unlisted senders get a neutral result.

Example

v=spf1 include:spf.example.net ip4:192.0.2.0/24 -all
This policy authorizes the servers in spf.example.net and the listed IPv4 range. Mail from any other source fails SPF.

FAQ

Questions about SPF

What does SPF check?
SPF checks whether the connecting IP address is allowed to send for the domain in the envelope sender (the Return-Path). It does not check the From address people see in their inbox. DMARC connects the two.
What is the SPF 10 lookup limit?
Receivers stop evaluating an SPF policy after 10 DNS lookups. The include, a, mx, ptr, and exists mechanisms and the redirect modifier each count, including those inside included records. Going over the limit returns a permanent error.
Can I publish two SPF records?
No. A domain must publish exactly one SPF record. Combine every authorized source into that record.
Should I use ~all or -all?
Use ~all (softfail) while you confirm every sender, then move to -all (fail) once the list is complete. With DMARC enforcement in place, receivers act on the DMARC policy, so the difference matters less.
How do I check an SPF record for a domain?
Enter the domain in the tool above. The result shows the record, each mechanism it contains, the lookup count, and any syntax errors.
What happens if my SPF record has too many lookups?
Receivers return a permanent error (permerror), and SPF fails for every message sent from that domain.

Keep checking

Related tools

  • Free DKIM checker

    Validate a DKIM public key by domain and selector, including algorithm, size, and revocation status.

  • Free DMARC checker

    Review a domain’s DMARC policy, alignment, reporting addresses, and enforcement.

  • PTR and reverse DNS checker

    Look up the reverse DNS (PTR) hostname for an IP address and confirm it resolves back to the same address.

  • Email header analyzer

    Inspect SPF, DKIM, and DMARC results, identify the sending IP, confirm reverse DNS, and trace the delivery path.

Sending with Prontuno?

Set up your sending domain

Prontuno publishes and verifies these records as part of domain setup.

Set up a sending domain
Specifications
RFC 7208: Sender Policy Framework (SPF) (opens in a new tab)