Free · no sign-up
Free SPF record checker
Look up a domain’s SPF record and find problems that break email authentication — multiple records, too many DNS lookups and unsafe “all” policies.
How the SPF checker works
We fetch the TXT records published at the domain, find the one that starts with v=spf1, and check it the way a receiving mail server would:
- exactly one SPF record exists;
- every mechanism and modifier is valid (
ip4,ip6,include,a,mx,exists,redirect,all); - the record stays within the 10 DNS lookup limit, following nested includes;
- the record ends with a safe
~allor-allpolicy.
An example SPF record
v=spf1 include:_spf.example-provider.com ip4:192.0.2.10 ~allThis allows the provider’s servers and one IP address to send for the domain, and asks receivers to treat everything else with suspicion. SPF works best together with DKIM and DMARC — see our plain-English guide to SPF, DKIM and DMARC.
Set up SPF automatically
When you add a sending domain to InboxRoads, we generate the exact SPF, DKIM and DMARC records for you and check them automatically — no guesswork.
Frequently asked questions
SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send email for your domain. Receiving mail servers check it to detect forged senders.
SPF allows at most 10 mechanisms that need a DNS query — include, a, mx, ptr, exists and redirect — counted across all nested includes. If a record needs more, SPF returns a permanent error and authentication fails.
"~all" (soft fail) asks receivers to accept but mark mail from unlisted servers; "-all" (fail) asks them to reject it. Both are acceptable once your record is complete. Never use "+all", which lets anyone send as your domain.
No. A domain must have exactly one SPF record. If you use several services, combine their includes into a single record.
Verify your whole list, not just one address
Upload a CSV and InboxRoads checks every address, removes duplicates for free and gives you clean files to download.