One record, and only one
A domain may publish one SPF record. Publish two and receivers evaluate neither, so none of your mail passes SPF.
SPF checker
Check your SPF record. Free, with no account.
Type in a domain. We read its SPF record from public DNS and grade it as the Full Report does: whether one is published, how it ends, how many lookups it costs and whether each include still answers.
Source: RFC Editor, RFC 7208.
- Reads only public DNS
- No account, nothing to install
- Checks DMARC as well
What the SPF checker looks at
How it ends
A record ending in -all tells receivers to refuse everyone not listed. One ending in ~all only marks them, and +all lets anyone send.
The ten-lookup limit
Every include costs at least one DNS lookup. Past ten, receivers stop reading and SPF fails. So do more than two lookups that find nothing.
Includes that still answer
An include that no longer resolves is flagged, because whoever registers that name next could send as you.
These are checks 1, 2 and 11 on the scanner page, graded by the same rules as the free check and the Full Report.
Reading an SPF record
DNS · TXT · yourcompany.co.ukExample
v=spf1 include:spf.protection.outlook.com -all
v=spf1 says this TXT record is an SPF record.
include:spf.protection.outlook.com adds Microsoft 365's list of sending servers. It costs one lookup, and Microsoft's list may cost more.
-all tells receivers to refuse mail from any server not listed.
More on SPF, and how a record we host stays under the limit as your senders change: SPF explained.
Questions
What is an SPF record?
A TXT record on your domain that lists the servers allowed to send email as you. A receiving server reads it to decide whether a message that claims to be from you came from one of them.
How do I check my SPF record?
Type your domain into the checker at the top of this page. It reads the record from public DNS, as a receiving server does, and grades it. You need no account.
Should my SPF record end in -all or ~all?
In -all, once every service that sends as you is listed. A record ending in ~all asks receivers to treat other senders as suspicious but still accept their mail. It is a sensible place to start while you find every sender.
What is the SPF ten-lookup limit?
Reading an SPF record may cost ten DNS lookups and no more. Each include costs at least one, and an include can hold includes of its own. Past ten, the receiving server returns an error and your mail fails SPF.
Can a domain have two SPF records?
No. With two, receivers treat SPF as broken and evaluate neither. Merge them into one record that lists every sender.
Does SPF on its own stop someone sending email as me?
No. SPF checks the hidden sender address servers use, not the From address people read. DMARC ties the two together and tells receivers what to do with mail that fails.
More free checkers
TXT · _dmarc
DMARC checker
Reads your instruction to inboxes about mail that fails, and whether its reports reach anyone.
Check DMARCTXT · selector._domainkey
DKIM checker
Reads the public keys that prove your email was signed by you, on the common selectors or your own.
Check DKIMTXT · _mta-sts · policy file
MTA-STS checker
Reads the policy that asks senders to deliver mail to you only over an encrypted connection, and your TLS reporting.
Check MTA-STS
Start with the free check.
It reads your SPF, DKIM and DMARC records in about 30 seconds, and tells you where you stand today.