# SPF Record Checker: Free SPF Lookup and Test

URL: https://email-validation.org/tools/spf-checker/
Updated: 2026-11-06

> Documentation index: https://email-validation.org/llms.txt

Enter a domain to see its SPF record, every record it includes and the total number of DNS lookups. Each problem is
explained in plain English with the change that fixes it. The check reads public DNS only and sends no email.

## What SPF does

SPF (Sender Policy Framework, [RFC 7208](https://www.rfc-editor.org/rfc/rfc7208)) lets a domain publish which servers
may send its mail. The receiving server looks up a TXT record that starts with `v=spf1` on the domain in the message's
envelope sender (the Return-Path) and compares the connecting server's IP address with the list. The answer is one of
pass, fail, soft fail, neutral, none, or an error.

SPF alone does not protect the From address people see: that is DMARC's job, which uses an SPF or DKIM pass only when
the checked domain matches the From domain. Check DMARC with our [DMARC checker](https://email-validation.org/tools/dmarc-checker/).

## How to read a record

A record is a list of terms evaluated left to right; the first one that matches decides the result.

| Term | Meaning | DNS lookup? |
| --- | --- | --- |
| `ip4:192.0.2.0/24`, `ip6:2001:db8::/32` | These addresses may send | No |
| `include:_spf.example.net` | Whatever that domain's SPF record allows | Yes |
| `a`, `mx` | The domain's own A/AAAA or MX hosts | Yes |
| `exists:`, `ptr` | Advanced and rarely needed (`ptr` should not be used) | Yes |
| `redirect=example.net` | Use another domain's record instead | Yes |
| `-all`, `~all`, `?all` | Everything else fails, soft-fails or is neutral | No |

Each term can start with a qualifier: `+` pass (the default), `-` fail, `~` soft fail, `?` neutral.

## The problems this checker finds

- **More than 10 DNS lookups.** Every `include`, `a`, `mx`, `ptr`, `exists` and `redirect` costs one lookup, counted
  across all included records. Past 10, receivers stop with a permanent error and SPF fails for every message
  ([RFC 7208 §4.6.4](https://www.rfc-editor.org/rfc/rfc7208#section-4.6.4)). Fix: remove services you no longer use,
  replace `a` and `mx` with the `ip4:`/`ip6:` ranges they stand for, or send bulk mail from a subdomain with its own
  record.
- **More than one SPF record.** A domain may publish only one; two or more make every check a permanent error
  ([§4.5](https://www.rfc-editor.org/rfc/rfc7208#section-4.5)). Fix: merge them into one record with one `all` at the end.
- **`+all` or a bare `all`.** It allows every server on the internet, so SPF passes for anyone. Fix: list your real
  senders and end with `~all` or `-all`.
- **`?all` or no `all`.** Unlisted servers get a neutral result, which tells receivers nothing.
- **Includes that do not exist.** An `include:` that points at a domain without an SPF record is a permanent error
  ([§5.2](https://www.rfc-editor.org/rfc/rfc7208#section-5.2)); often a provider changed its include name. More than
  two lookups that return nothing ("void lookups") may also stop the check.
- **Syntax errors.** Unknown terms such as `ipv4:` or an invalid address range make the whole record fail
  ([§5](https://www.rfc-editor.org/rfc/rfc7208#section-5)).
- **Terms after `all`** never match (evaluation stops at `all`), and `redirect=` is ignored when `all` is present
  ([§6.1](https://www.rfc-editor.org/rfc/rfc7208#section-6.1)).
- **`ptr`.** Slow and unreliable; RFC 7208 §5.5 says it should not be used.

## Soft fail or fail?

`~all` (soft fail) and `-all` (fail) both tell receivers that unlisted servers are not yours. Most large mailbox
providers weigh them the same way and leave the final decision to DMARC, so `~all` is the usual choice while you
confirm that every sender is listed. Use `-all` when you are sure, for example on a domain that sends no mail at all:
`v=spf1 -all`.

## Requirements of the large mailbox providers

Since 2024 Gmail and Yahoo require SPF or DKIM on all mail, and SPF, DKIM and DMARC from bulk senders; Outlook.com
has applied the same rules to high-volume senders since 2025. See
[Google's sender guidelines](https://support.google.com/a/answer/81126) and
[Yahoo's sender requirements](https://senders.yahooinc.com/best-practices/). Build a new record with our
[SPF generator](https://email-validation.org/tools/spf-generator/).

Checking email addresses rather than domains? Try our [free email checker](https://email-validation.org/email-checker/) or see [pricing](https://email-validation.org/pricing/) for lists and the API.

## Frequently asked questions

### What is the SPF 10 lookup limit?

Receivers stop evaluating an SPF record after 10 DNS lookups, counting every include, a, mx, ptr, exists and redirect, including those inside included records. Past 10, SPF returns a permanent error and fails for every message (RFC 7208 section 4.6.4).

### Can a domain have two SPF records?

No. With more than one TXT record starting with v=spf1, receivers return a permanent error. Merge all mechanisms into a single record that ends with one all term.

### Does this checker send an email?

No. It reads the public DNS records of the domain you enter, through a DNS-over-HTTPS resolver, and explains them in your browser. Nothing is sent to the domain.