Email

SPF Record Lookup

Sender Policy

Look up SPF records

Enter a domain name to check its SPF (Sender Policy Framework) record and verify email authentication policies.

DNS Resolver

Most domains return the same records on every resolver — the choice matters during DNS propagation, or when a filtering resolver blocks a domain.

Tool features

Comprehensive SPF record analysis and email authentication validation
4 checks

Email Authentication

Verify SPF records that control email sending authorization

Security Validation

Check for proper SPF configuration and security policies

Fast Analysis

Quick SPF record lookup with detailed parsing and validation

Compliance Check

Ensure SPF records follow RFC 7208 standards and best practices

What is an SPF record & how it works

How a domain authorises its mail senders

SPF (Sender Policy Framework) is a TXT record that lists which mail servers are allowed to send email for your domain. Receiving servers check the sender's IP against this list to decide whether a message is legitimate or forged — a core defence against spoofing and phishing.

An SPF record is a single v=spf1 string built from mechanisms (ip4, a, mx, include) ending in an all policy. This tool expands every include and redirect, counts the DNS lookups against the 10-lookup limit, and flags anything that would cause a permerror.

include
Authorises another domain’s SPF record — each one costs a DNS lookup.
-all / ~all
The final policy: hard fail (-all) rejects, soft fail (~all) marks suspicious.
10-lookup limit
SPF permits at most 10 DNS-querying mechanisms before it fails.

How to use this tool

Check a domain's SPF policy in four steps
1
Enter a domain
Type a domain, e.g. example.com — SPF is published on the registrable domain that sends mail.
2
Pick a resolver (optional)
Open Advanced Settings to query a specific public resolver such as Google (8.8.8.8) or Cloudflare (1.1.1.1).
3
Run the lookup
Click Check SPF Records to fetch the record and recursively expand every include and redirect.
4
Review the results
Read the mechanism breakdown, watch the 10-lookup budget, and follow the diagnostics and recommendations.

Related tools

Keep debugging with tools from the same suite
5 tools
SPF Generator
Generate SPF records to authorize mail servers for your domain with visual builder
SPF Validator
Validate SPF record syntax and check for configuration errors and best practices
DMARC Lookup
Check DMARC policy records for email authentication, reporting, and policy enforcement
DKIM Lookup
Find DomainKeys Identified Mail (DKIM) records for email message signing and verification
Email Health Checker
Comprehensive email deliverability check including SPF, DKIM, DMARC, and MX records

Frequently asked questions

Common questions about SPF records
5 Q&A

SPF (Sender Policy Framework) is a TXT record that lists the servers authorised to send email for your domain, so receivers can detect forged senders.

SPF allows at most 10 mechanisms that trigger a DNS lookup (include, a, mx, ptr, exists, redirect). Exceeding it makes the whole record fail with a permerror, so keep includes lean.

-all (hard fail) tells receivers to reject mail from unlisted servers; ~all (soft fail) tells them to accept but mark it as suspicious. Use -all once you are confident every legitimate source is listed.

No. A domain must publish exactly one v=spf1 TXT record. Two or more SPF records cause a permerror — merge them into a single record instead.

SPF authenticates the envelope sender, but on its own it does not protect the visible From address. Pair it with DKIM and a DMARC policy for full protection.