Skip to content

Free SPF checker

Check the SPF record of any domain

Enter a domain to look up its SPF record, follow every include and count the DNS lookups receivers make. The same report checks DMARC and DKIM.

Try: github.com · google.com · proton.me

How it works

How SPF works

When a server receives a message, it reads the domain in the envelope sender (the Return-Path) and looks up that domain's SPF record. If the sending server's IP address matches a mechanism in the record, SPF passes. If nothing matches, the all mechanism at the end decides the result.

SPF alone does not stop spoofing of the From address people see, because it checks the envelope sender only. DMARC closes that gap: it requires SPF or DKIM to pass for the same domain as the visible From address, and it tells receivers what to do when neither does.

ip4 / ip6
Allows an IPv4 or IPv6 address or range
include
Allows the servers in another domain's SPF record
a / mx
Allows the domain's own A or MX hosts
all
Matches everything else: -all fail, ~all soft fail
redirect
Uses another domain's SPF record instead

FAQ

SPF checker FAQ

Common questions about SPF records and why they fail.

Free lookup tool

Check the SPF record of any domain

Check the SPF record of any domain. See every include, the DNS lookup count against the limit of 10, the all qualifier and the errors that make SPF fail.