Email Tools

SPF Checker

Check whether a domain has a valid SPF record configured.

Enter a domain to check its SPF record.

More Email Tools

DMARC Record Generator DKIM Checker Email Header Analyzer DMARC Checker Email Security Summary SMTP Connectivity Checker Mail Server Lookup

JustChecker tracks your email authentication records continuously.

What Is SPF?

SPF (Sender Policy Framework) is a TXT record listing the servers allowed to send email for a domain, for example v=spf1 include:_spf.google.com ~all. Receiving servers use it to spot forged senders. This tool finds and checks a domain's SPF record.

When to Use It

After setting up an email provider, newsletter tool or CRM that sends as your domain.
When your emails land in spam.

How to Use It

Enter the domain.
Review the record and the mechanisms it contains.

Understanding the Result

A domain must have exactly one record starting with v=spf1. -all (fail) and ~all (soft fail) tell receivers what to do with unlisted senders; +all allows anyone and defeats the purpose.

Limitations

SPF allows at most 10 DNS lookups (includes, a, mx and similar); exceeding it makes SPF fail. SPF alone does not stop spoofing of the visible From address - add DKIM and DMARC.

Example Records

Setup	SPF record
Google Workspace only	`v=spf1 include:_spf.google.com ~all`
Microsoft 365 only	`v=spf1 include:spf.protection.outlook.com -all`
Google + a newsletter service	`v=spf1 include:_spf.google.com include:servers.mcsv.net ~all`
Domain that never sends email	`v=spf1 -all`

Use the exact include: value each provider documents; the ones above are examples.

Common Mistakes

Two SPF records. Adding a second v=spf1 TXT record for a new service makes SPF fail - merge them into one.
Too many lookups. SPF allows at most 10 DNS lookups (include, a, mx and so on). Too many services pushes you over, and SPF returns an error.
Forgetting a sender. Invoicing software, a CRM or a website contact form sending as your domain must be listed.
Using +all, which lets anyone send as you.

SPF Is Not Enough on Its Own

SPF checks the hidden envelope sender, not the "From" address people see. Combine it with DKIM and DMARC. Check them with the DKIM Checker and DMARC Checker, and read SPF, DKIM and DMARC explained.

Frequently Asked Questions

SPF ("Sender Policy Framework") publishes which mail servers are authorized to send email on your domain's behalf - receiving mail servers check this list, making it harder for an attacker to send forged email that appears to come from your domain.

SPF alone is only one of several signals receiving mail servers weigh - DKIM and DMARC configuration, sender reputation, and content-based spam filtering all factor in independently; SPF being correct doesn't guarantee delivery on its own.

SPF records have a hard limit of 10 DNS lookups during evaluation - including services like Google Workspace, Mailchimp, or other senders each adds lookups, and exceeding the limit causes receiving servers to treat the entire SPF check as failed.

"-all" (hard fail) tells receiving servers to reject mail from unlisted senders outright; "~all" (soft fail) asks them to flag it as suspicious but not necessarily reject it - "-all" is stricter and generally recommended once you're confident your SPF record is complete.

SPF records don't automatically inherit to subdomains - if you send mail from a subdomain, it typically needs its own explicitly configured SPF record rather than relying on the root domain's.

Yes - modern receiving servers increasingly expect DKIM and a DMARC policy alongside SPF; having only SPF configured is a good start but leaves gaps that DMARC and DKIM specifically close.