SPF Record Checker
Enter a domain to look up its SPF record and see which servers are authorized to send email.
What is an SPF record?
SPF (Sender Policy Framework) is a DNS TXT record that lists the mail servers, IP ranges, and third-party services authorized to send mail on behalf of your domain. When a message arrives, the receiving server looks up the sender domain's SPF record and checks whether the connecting IP is on the list. It is one half of the authentication pair DMARC relies on, alongside DKIM.
How to read the result
Each mechanism in the record carries a qualifier: + (Pass, the default),- (Fail), ~ (SoftFail), or? (Neutral). The final mechanism — usually all — sets the default outcome for any sending IP not explicitly matched above it, and is the strongest signal of how strictly the domain enforces SPF.
Common failure causes
- Exceeding the 10 DNS-lookup limit, which invalidates the entire check with a permerror.
- Publishing more than one SPF TXT record — receivers reject the domain outright when they find two.
- Forgetting to add a new email platform's include after switching providers.
- Leaving the record at
~allindefinitely instead of tightening to-allonce every sender is confirmed.
Frequently asked questions
What is the SPF 10-lookup limit?
Every "include", "a", "mx", "ptr", and "exists" mechanism costs one DNS lookup, and the spec caps a single SPF check at 10. Go over it and receiving servers return a permerror and treat the check as a fail — regardless of whether the sending IP was actually authorized. Nested includes from marketing tools are the usual culprit.
What is the difference between -all and ~all?
-all (fail) tells receivers to reject mail from any IP not explicitly listed. ~all (softfail) asks them to accept it but mark it as suspicious. Most domains start with ~all while testing and move to -all once they have confirmed every legitimate sending source is included.
Do I need SPF if I already have DMARC?
Yes. DMARC does not authenticate mail on its own — it relies on SPF and/or DKIM passing and being aligned to the From domain. A domain with DMARC but no SPF record has to rely entirely on DKIM alignment, which fails for any provider that only supports SPF.
Keep an eye on this automatically
A one-off check tells you how things look right now. DMARC.WS collects your aggregate reports continuously, shows you which senders are failing authentication, and alerts you when something changes.
Free plan includes 5 domains. No card required.