Free SPF Checker - Inspect Your SPF Record
Enter a domain to inspect its published SPF TXT record. MXScan checks the record's presence and visible configuration, highlights risky mechanisms such as +all, and identifies terms that can trigger DNS queries during SPF evaluation. This preview does not fully evaluate every nested include or redirect, and it cannot prove whether a particular email passes SPF.
DNS configuration preview. Recursive lookup totals and message-level authentication are not verified by this check.
This example performs a real DNS lookup for google.com. Results may change. It does not assess your domain or verify message-level email authentication.
What does the SPF checker inspect?
SPF record presence
Checks for a DNS TXT record beginning with v=spf1 at the queried domain.
Published SPF configuration
Displays the policy and identifies recognizable mechanisms, qualifiers, and modifiers that may need review.
Lookup-causing terms in the published record
Highlights include, a, mx, ptr, exists, and redirect. Nested evaluation can add further DNS work, so the number shown by this preview is not necessarily the total SPF evaluation cost.
Potential configuration concerns
Explains multiple SPF records, permissive +all policies, and patterns that warrant further checking. These findings are configuration observations, not evidence that any particular email was accepted or rejected.
Why can an SPF record with only a few includes still return PermError?
SPF has a limit of 10 DNS-querying mechanisms and modifiers during an evaluation. An include or redirect may cause SPF to examine additional records, so counting only the terms visible in the starting TXT record is not enough to establish that every evaluation path stays within the limit. The evaluation also depends on the sending IP address and which policy terms are reached.
The terms that count toward that limit are include, a, mx, ptr, exists, and redirect. The ip4, ip6, and all mechanisms do not consume this particular lookup-term allowance. A complete PermError diagnosis requires evaluating the relevant policy path, including nested lookups.
For a focused explanation, see SPF PermError and the 10-lookup limit. The standard is RFC 7208, section 4.6.4.
How to interpret SPF qualifiers
+allauthorizes every source that reaches that mechanism and is usually inappropriate for a domain intending to restrict senders.~allmarks otherwise unmatched sources as softfail. It is not automatically an error.-allmarks otherwise unmatched sources as fail. Consider it only after identifying all legitimate sending services and testing their authentication.?allreturns a neutral result for otherwise unmatched sources and provides little protection by itself.
Do not copy a generic SPF record into production. SPF mechanisms must match the providers and IP addresses that actually send your mail.
What SPF checking cannot establish by itself
A valid SPF TXT record does not prove that a real outgoing email passed SPF, that SPF aligned with the address displayed in the message's From header, or that the message reached the inbox. The actual SPF result depends on the connecting IP and the identity evaluated by the receiver. DMARC adds a separate alignment requirement; learn more in the DMARC alignment checker.
Related reading: What is an SPF record?
How It Works
Enter Your Domain
Type your domain name without http:// or www
We Query DNS
Our tool fetches and parses your SPF TXT record
Get Instant Results
Review the published record. The term count is not a complete nested evaluation.
Frequently Asked Questions
Can this tool check all nested SPF DNS lookups?
Not currently. It inspects the published SPF record and identifies lookup-causing terms, but it does not run a complete recursive SPF evaluation through every nested include or redirect. The total can be different from the count shown in this preview.
Is ~all wrong, and should I change it to -all?
No. A softfail policy is not automatically wrong. Before considering a hard-fail policy, inventory every legitimate sender, verify SPF and DKIM behavior for real messages, and test changes carefully.
Does a valid SPF record mean my emails will reach the inbox?
No. SPF is only one part of authentication. Receiving servers also consider DKIM, DMARC alignment, sender reputation, content, and other delivery factors.
Can a single SPF TXT record exceed 255 characters?
Yes. DNS TXT data may be published as several strings, each with its own size limit; those strings are concatenated for SPF interpretation. A long SPF policy is not automatically invalid just because its combined text exceeds 255 characters.
Understanding SPF Records: The Complete Guide
SPF (Sender Policy Framework) is an email authentication protocol that allows domain owners to specify which mail servers are authorized to send email on behalf of their domain. Published as a DNS TXT record, SPF helps receiving mail servers verify that incoming email from your domain comes from an authorized source.
How SPF Works
When an email arrives, the receiving server checks the sender's domain for an SPF record. It then compares the sending server's IP address against the list of authorized servers in the SPF record. If there's a match, SPF passes. If not, the SPF result depends on your policy qualifier.
An SPF record starts with v=spf1 and contains mechanisms that define authorized senders:
- ip4/ip6 - Authorize specific IP addresses or ranges
- include - Reference another domain's SPF record (e.g.,
include:_spf.google.com) - a - Authorize the domain's A record IP
- mx - Authorize the domain's mail servers
- all - The catch-all mechanism that defines what happens to non-matching senders
Understanding the SPF 10-lookup limit
SPF evaluation allows at most 10 DNS-query-causing terms across the evaluation path, including nested include and redirect evaluations. The mechanisms and modifier involved are include, a, mx, ptr, exists, and redirect. ip4, ip6, and all do not count toward this limit. An evaluation that exceeds the limit returns permerror. The relevant count depends on the mechanisms actually evaluated; the number of visible include tags alone is not the answer.
If a check reports too many lookups, first identify unused sending services and obsolete include entries. Review the evaluated lookup chain and consult your email provider's current published SPF instructions. Avoid replacing a provider-managed include with static IP addresses unless you can maintain that list as the provider changes its infrastructure.
Can an SPF record exceed 255 characters?
A single DNS TXT character-string is limited to 255 octets, but a TXT record can contain multiple strings that are concatenated for SPF interpretation. Do not shorten an otherwise valid policy solely because its displayed text exceeds 255 characters. Validate the actual published TXT record and its SPF syntax.
How to fix multiple SPF records
A domain must not publish multiple TXT records that each begin with v=spf1. That situation can cause SPF permerror. Combine the sender mechanisms you genuinely require into one SPF policy, then test it before deployment. Other unrelated TXT records, such as verification records, can coexist with SPF.
SPF specification: RFC 7208.
Related reading: What is an SPF record? and SPF record too long.
Monitor Your SPF Record Daily
Get alerts when your SPF record changes or exceeds the lookup limit.
Start Free Monitoring