Free SPF Record Checker

What the SPF checker tests

SPF tells receiving mail servers which servers may send email for your domain. A broken record does not just fail silently: depending on the error, receivers may treat every message from your domain as unauthenticated. This tool runs the same checks a receiving server would, plus a few best-practice warnings:

• Record exists. Without an SPF record, receivers cannot verify any of your senders.
• Exactly one record. Two TXT records starting with v=spf1 cause a permanent error. This is one of the most common mistakes, usually made when a new email service asks you to "add" an SPF record instead of editing the existing one.
• Valid syntax. Every term must be a known mechanism (ip4, ip6, a, mx, include, exists, all) or modifier (redirect, exp). A typo anywhere invalidates the whole record.
• The all mechanism. The record should end with ~all or -all. +all lets anyone send as your domain, and ?all offers no protection.
• The 10 lookup limit. The checker follows every include and redirect, including nested ones, and adds up the DNS lookups they cost.

How to read an SPF record

A typical record for a company using Google Workspace and a marketing platform looks like this:

v=spf1 include:_spf.google.com include:servers.mcsv.net ip4:203.0.113.10 ~all

• v=spf1 marks the record as SPF version 1. It must come first.
• include:_spf.google.com authorises every server listed in Google's own SPF record. Each include costs at least one lookup.
• ip4:203.0.113.10 authorises a single server by IP address. IP mechanisms cost no lookups.
• ~all soft-fails everything else.

How to fix common SPF errors

Multiple SPF records

Combine them. Keep one v=spf1 at the start and one all at the end, and place every include and ip4/ip6 term from both records in between. Then delete the second record.

Too many DNS lookups

Remove includes for services you no longer use. Replace a and mx with the server IPs if they rarely change. For services that publish fixed ranges, you can list their ip4/ip6 ranges directly (often called flattening), but you then have to update the record yourself whenever the provider changes its servers.

Record ends in +all or has no all

Change the ending to ~all today, confirm in your DMARC reports that all legitimate mail passes, then tighten it to -all.

SPF is only part of deliverability

Authentication proves mail really comes from you. Mailbox providers also watch how many of your messages bounce. Sending to addresses that no longer exist pushes your bounce rate up and your sender reputation down, even with perfect SPF, DKIM and DMARC. Verifying your list before a campaign removes invalid, disposable and risky addresses so authentication and list quality work together.