SPF Record Checker
Validate SPF records for any domain via DNS-over-HTTPS TXT record lookup. Parse and analyze every mechanism (include, a, mx, ip4, ip6, all), count DNS lookups against the RFC 7208 10-limit, and detect common misconfigurations that affect email deliverability - all in your browser with no signup required.
Validate SPF records for any domain via DNS-over-HTTPS TXT record lookup. Checks syntax, DNS lookup limits (max 10), and common misconfigurations affecting email deliverability.
Enter a domain name to check its SPF record
Why Use Our SPF Record Checker?
Full SPF Syntax Validation
Parse and validate every mechanism in your SPF record - v=spf1, include, a, mx, ip4, ip6, exists, redirect, exp, and all. Our parser flags syntax errors, unknown mechanisms, and malformed IP addresses with clear, actionable messages.
DNS Lookup Limit Checker
SPF records must not require more than 10 DNS lookups (RFC 7208). Our tool counts every lookup including those from included domains and warns you before you hit the PermError limit.
Common Misconfiguration Detection
Automatically detect issues like missing ~all/-all policy, duplicate include domains, outdated ptr mechanisms, redirect not at the end, and +all policies that leave your domain open to spoofing.
DNS-over-HTTPS (DoH)
All SPF queries are sent via encrypted DNS-over-HTTPS to Cloudflare (1.1.1.1). Your DNS queries are private and secure with no logging or storage of any domain lookups.
Common Use Cases for SPF Record Checker
Email Deliverability Troubleshooting
If your emails are landing in spam folders or being rejected, a misconfigured SPF record is often the cause. Our checker validates your SPF record and identifies issues that could cause receiving servers to reject your messages.
Adding a New Email Service Provider
When you add a new email service like SendGrid, Mailgun, or Amazon SES, you need to update your SPF record with their include mechanism. Our tool verifies your new SPF record stays within the 10-lookup limit.
Email Authentication Audit
Regularly audit your SPF records alongside DKIM and DMARC as part of your email authentication hygiene. Our checker ensures your SPF record uses the correct policy (~all or -all) and has no redundant mechanisms.
Domain Migration Validation
When migrating a domain to a new hosting provider or DNS service, verify that your SPF record was correctly transferred and still validates. Catch DNS migration issues before they affect email delivery.
Security Assessment & Hardening
Review SPF records during security assessments to ensure domains are protected against email spoofing. Check for weak policies like +all or ?all that leave your domain vulnerable to impersonation attacks.
Bulk Domain SPF Validation
Quickly check SPF records across multiple domains you manage. Use Quick Test presets or enter any domain individually - ideal for agencies, IT administrators, and email security teams.
Understanding SPF Records
What is an SPF Record?
An SPF (Sender Policy Framework) record is a type of DNS TXT record that specifies which mail servers are authorized to send email on behalf of your domain. Published as a v=spf1 record, it contains mechanisms like include, a, mx, ip4, and ip6 that define authorized sources, and ends with a policy qualifier like ~all (softfail) or -all (hardfail) to handle unauthorized senders. Without an SPF record, receiving mail servers have no way to distinguish legitimate email from forged or spoofed messages.
How Our SPF Record Checker Works
- Enter a Domain: Type any domain name (e.g., gmail.com, your-domain.com) and click "Check SPF Record". Your browser queries Cloudflare DNS-over-HTTPS for the domain's TXT records.
- SPF Record Parsing:Our parser finds the v=spf1 record among all TXT records and breaks it down into individual mechanisms. Each mechanism's qualifier (+, -, ~, ?), type (include, a, mx, ip4, etc.), and arguments are extracted and validated.
- Validation & Analysis: The tool checks SPF syntax, counts DNS lookups (with a live progress bar showing usage against the 10-lookup limit), detects common misconfigurations, and provides a status: Valid, Warning, Invalid, or Not Found.
SPF Mechanisms Explained
- include:Delegates authorization to another domain's SPF record. Each include counts as one DNS lookup (e.g., include:_spf.google.com).
- a / mx:Authorizes the domain's A record IP or MX server IPs to send email. A or mx without a domain counts as one lookup each.
- ip4 / ip6: Directly specifies authorized IP addresses or CIDR ranges. These do not count toward the DNS lookup limit.
- all: The catch-all mechanism that specifies the default policy. ~all (softfail) marks unauthorized mail as suspicious. -all (hardfail) rejects it.
- exists: A test mechanism that checks if a domain resolves. Rarely used in practice.
- redirect:Points to another domain's SPF record. Should be the last mechanism.
Privacy, Security & Availability
Our SPF Record Checker processes everything locally in your browser. Your DNS queries go directly from your browser to Cloudflare DNS-over-HTTPS - we do not store, log, or process your queries on any server. The tool is 100% free with no signup, no account, and no usage limits. All computation happens client-side, so your domain lookups remain private and never leave your device beyond the encrypted DoH query.
Related Tools
DMARC Record Checker
Check DMARC records for any domain via Cloudflare DNS-over-HTTPS. Validate email authentication policy (none/quarantine/reject), analyse alignment settings (adkim, aspf), and extract reporting addresses (rua, ruf) - free online DMARC record checker.
DNS Leak Test
Check if DNS queries and WebRTC are leaking your real IP outside your VPN tunnel. Detects local IPs via WebRTC STUN requests, checks public IP and geolocation via free APIs, and identifies DNS resolvers - free online DNS leak test.
DNS Record Comparator
Compare DNS records across Cloudflare, Google, and Quad9 nameservers automatically. Detects differences in A, MX, NS, CNAME, TXT, AAAA, and SOA records with severity indicators - free online DNS comparison tool.
Reverse DNS Lookup
Look up PTR records for any IPv4 or IPv6 address via Cloudflare DNS-over-HTTPS. Instantly find the hostname behind any IP address with DNSSEC validation status and query time - free online reverse DNS lookup tool.
Frequently Asked Questions About SPF Record Checker
SPF (Sender Policy Framework) is a DNS TXT record that specifies which mail servers are authorized to send email on behalf of your domain. It helps prevent email spoofing and improves deliverability by giving receiving mail servers a way to verify that a message originated from an authorized source.
Enter your domain name in the input above and click "Check SPF Record". We query your domain's TXT records via DNS-over-HTTPS and automatically find and validate the v=spf1 record. The results show your full SPF record, a breakdown of each mechanism, DNS lookup count, and any issues found.
SPF records are limited to a maximum of 10 DNS lookups (RFC 7208). Each include, a, mx, exists, and ptr mechanism counts as a lookup. If your SPF record exceeds 10 lookups, receiving servers will return a PermError and may reject your email. Our tool counts lookups for you and shows a visual progress bar.
Use ~all (softfail) to mark unauthorized email as suspicious without hard rejection - this is safer during migration. Use -all (hardfail) to explicitly reject unauthorized email once you have confirmed all legitimate senders are covered. Never use +all, which authorizes any server to send email as your domain.
Without an SPF record, receiving mail servers have no way to verify legitimate email from your domain. This increases the likelihood of your emails being marked as spam or rejected outright. It also makes your domain vulnerable to spoofing, where attackers can send forged emails that appear to come from your domain.
SPF verifies the sending server's IP address is authorized. DKIM uses cryptographic signatures to verify email integrity. DMARC tells receiving servers how to handle email that fails SPF or DKIM checks. All three work together as part of a complete email authentication strategy - SPF alone is not sufficient for full protection.
No. Your SPF queries go directly from your browser to Cloudflare's DNS-over-HTTPS endpoint. We do not store, log, or process your queries on any server. Each query is processed entirely in your browser session.
Yes! 100% free with no signup, no account, and no usage limits. Check SPF records for any domain as many times as you need, with no rate limiting or hidden charges.