SPF Record Validator
Validate an SPF record
SPF record to validate
Paste a record to check it against RFC 7208 — parsed entirely in your browser.
Tool features
4 checks
RFC 7208 Compliance
Validates SPF records according to RFC 7208 standards for email authentication
Term-by-Term Syntax Check
Every mechanism and modifier is parsed and checked individually, with plain-English detail
Email Security
Catch +all, missing policies, and deprecated mechanisms before they weaken your defenses
DNS Integration
Fetch a domain's published SPF record automatically, or validate a record you paste in
What SPF validation checks & why it matters
SPF validation checks that a v=spf1 record is written the way RFC 7208 requires. A record with a stray character, a duplicated all, or an unknown modifier is not simply ignored — receiving servers return a permerror and your authentication result is lost.
This validator parses the record term by term: every mechanism (ip4, a, mx, include, exists, ptr) and modifier (redirect, exp) is checked for correct syntax, qualifier and placement. It also counts the DNS-querying terms against the 10-lookup limit and flags weak policies such as +all before you publish.
Syntax error
A term the RFC does not define, or one written in a form parsers reject.
permerror
A permanent failure — the record is unusable and SPF returns no useful result.
10-lookup limit
SPF permits at most 10 DNS-querying mechanisms before the record fails.
How to use this tool
1
Paste a record or look it up
Paste an SPF string beginning with
v=spf1, or switch to “Look up by domain” to fetch the published record.2
Edit before validating (optional)
Tweak the record in the box to test a change safely — nothing is published, the parse runs in your browser.
3
Run the validation
Click Validate for a term-by-term syntax report, a grade and the RFC 7208 rule checks.
4
Fix and re-check
Work through the recommendations, paste the corrected record back in, and re-validate until the grade is clean.
Related tools
4 tools
SPF Lookup
Check Sender Policy Framework (SPF) records for email authentication and mail server authorization
SPF Generator
Generate SPF records to authorize mail servers for your domain with visual builder
Email Health Checker
Comprehensive email deliverability check including SPF, DKIM, DMARC, and MX records
Fix Email Issues
Get recommendations and solutions to fix email deliverability problems and configuration issues
Frequently asked questions
5 Q&A
The validator checks a record you paste (or fetch) for correct syntax and RFC compliance. The SPF lookup tool queries a live domain and recursively expands every include and redirect to show the resolved policy. Use the validator while drafting a record, and the lookup tool to audit what is published.
Common causes are two v=spf1 TXT records on the same name, an unknown mechanism or modifier, a missing or misplaced all term, a malformed ip4/ip6 range, or more than 10 DNS-querying mechanisms. The term-by-term report marks the exact term at fault.
Yes. In paste mode the record is parsed entirely in your browser and is never sent to a server. Only the optional domain look-up makes a DNS query.
-all (hard fail) tells receivers to reject mail from unlisted servers and is the stronger setting. ~all (soft fail) accepts but marks the mail as suspicious — a reasonable temporary state while you confirm every legitimate sending source is listed.