Free SPF Record Checker — plain-English results
Enter a domain to see its SPF record explained mechanism by mechanism, with a check against the SPF 10-lookup limit. No signup required.
Runs entirely in your browser using public DNS-over-HTTPS. We never store your query.
Watch every client domain and forward each client a branded weekly verdict. One flat price covers your whole plan.
✅ SPF is only one of three. Check your DMARC record → · Generate a DMARC record → · Check inbound TLS (MTA-STS & TLS-RPT) →
Frequently asked questions
What is SPF?
SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are allowed to send email using your domain. When a receiving server gets a message claiming to be from you, it checks your SPF record to decide whether the sending server is authorized. It helps stop spammers from forging your domain in the "envelope" sender address.
Why does the 10-lookup limit matter?
Evaluating SPF may require DNS lookups for mechanisms like include, a, mx, ptr, exists, and redirect. The specification caps this at 10 lookups. Go over and receivers return a "permerror" — which usually means legitimate mail fails SPF entirely. Many people hit the limit by chaining several vendor include: statements, so it is worth counting.
SPF vs DKIM vs DMARC — what's the difference?
SPF authorizes which servers may send for your domain. DKIM adds a cryptographic signature that proves a message wasn't tampered with in transit. DMARC ties SPF and DKIM to the visible "From" address and tells receivers what to do when checks fail — plus it sends you reports. You generally want all three, and DMARC is the one that gives you visibility. That's what PlainDMARC monitors for you in plain English.
What an SPF record contains
SPF is one DNS TXT record at your domain root that starts with v=spf1 and lists the servers allowed to send mail as you. It is built from mechanisms:
include:— trust another domain's SPF (how you authorise Google, Microsoft, a newsletter tool, and so on).aandmx— authorise your own A/MX hosts.ip4:/ip6:— authorise specific addresses.allat the end, with a qualifier:-all(hard fail) or~all(soft fail).
The 10-lookup limit
This is the rule that trips most people. Every include, a, mx and a few other mechanisms cost a DNS lookup, and the SPF standard caps the total at ten. Go over and receivers return PermError — and treat your SPF as broken. This checker counts your lookups for you. If you are over, flatten a rarely-changing include to its ip4: ranges, or drop senders you no longer use.
~all vs -all
The ending decides what a receiver does with mail from a server not on your list. -all says reject it; ~all says accept but mark it suspicious. Most senders should aim for -all once they are sure every legitimate source is listed — but get there carefully, because a missed sender means lost mail. There is a full walkthrough in softfail vs hardfail.
Common SPF mistakes
- Two SPF records. You may publish only one
v=spf1record. A second one is a PermError. - A forgotten sender. Every tool that sends on your behalf needs its
include, or its mail fails. - Using ptr. It is deprecated and slow; receivers may ignore it.
SPF is only part of it
SPF authenticates the envelope, which forwarding can break, and it is not tied to the address your reader sees. DMARC fixes both. Pair this with the DMARC checker and DKIM checker.
A one-off check is a snapshot — DMARC needs watching
PlainDMARC monitors your domains continuously and sends a weekly plain-English verdict per domain — what passed, what failed, and what to fix.