Skip to content
MailTwin

SPF record checker

Enter a domain to read its SPF record from live DNS, follow every include, and count the DNS lookups against SPF's hard limit of 10.

You can also paste a URL or an email address.

Try: , ,

What the SPF check looks at

SPF (Sender Policy Framework, RFC 7208) is a TXT record at the root of your domain that lists the servers allowed to send email for it. Receiving mail servers look it up for the envelope sender (the Return-Path address) of every message. The checker evaluates the record the way a receiver would:

  • One record only. A domain must publish exactly one TXT record starting with v=spf1. Two or more make every SPF check fail with a PermError.
  • The 10-lookup limit. The terms include, a, mx, ptr, exists and the redirect modifier each cost one DNS lookup, and lookups inside included records count too. ip4, ip6 and all are free. More than 10 is a PermError.
  • Void lookups. A lookup that returns no records (NXDOMAIN or an empty answer) is a void lookup. RFC 7208 lets receivers fail SPF after two of them, so includes pointing at retired services are a real risk.
  • The all mechanism. -all (fail) and ~all (soft fail) are normal endings. ?all is neutral and +all authorises every server on the internet.
  • Loops and syntax. Includes that point back to themselves, unknown mechanisms and malformed IP ranges are reported with the exact term.

A typical SPF record

example.com. IN TXT "v=spf1 include:spf.protection.outlook.com include:_spf.google.com ip4:203.0.113.10 -all"

This authorises Microsoft 365, Google Workspace and one on-premises server, and fails everything else. The two includes cost one lookup each, plus whatever lookups they contain. The checker shows the full chain so you can see where your budget goes.

Reading the result

ResultWhat it meansWhat to do
Lookups 11 or moreReceivers return PermError and SPF fails for all of your mail.Remove unused includes or replace them with ip4/ip6 ranges. See the lookup guide.
Lookups 8 to 10Working, but one more service or a provider adding an include will break it.Trim before adding new senders.
Multiple SPF recordsPermError on every message.Merge them into one record.
Void lookupsAn include or a/mx term resolves to nothing.Remove the term, or fix the target domain.
+all or ?allAnyone can pass SPF as your domain, or SPF gives no answer.End with -all, or ~all while you roll out DMARC.
No SPF recordReceivers cannot tell legitimate servers from forged ones.Publish one, or v=spf1 -all if the domain never sends.

SPF alone does not stop spoofing

SPF checks the hidden envelope sender, not the From address people see in their inbox. An attacker can pass SPF with their own domain and still show yours in From. DMARC closes that gap by requiring SPF or DKIM to pass for the same domain as the visible From address. Check it with the DMARC checker, or run the full domain check to see SPF, DMARC and mail servers together.

-all or ~all?

Once DMARC is enforced, receivers act on the DMARC result, so ~all and -all behave almost the same for most mail. -all is still the stronger statement, and the Australian ISM asks for a hard fail record (ISM-1183). Use ~all while you are still discovering senders, then move to -all.