SPF Check
Find and parse a domain's SPF record and its policy.
No results yet
Enter a domain above and press Run to start the check.
About the SPF Check
SPF Check finds and parses a domain's Sender Policy Framework record, published as a TXT record beginning with v=spf1. It breaks down the mechanisms and qualifiers, such as include, a, mx, ip4, and the all policy, so you can see exactly which servers are authorized to send mail for the domain. Correct SPF helps prevent spoofing and improves the chances that legitimate mail reaches the inbox.
How to use
- Enter the domain whose SPF policy you want to review.
- Run the check to locate and parse the v=spf1 TXT record.
- Inspect the listed mechanisms and the final all qualifier.
The ten-lookup limit, and why `-all` matters less than you think
SPF caps the number of DNS lookups a receiver must perform at ten, and exceeding it is a `permerror` — which most receivers treat as no SPF at all. The count is recursive, not a count of what you can see: every `include:`, `a`, `mx`, `ptr`, `exists` and `redirect=` costs one, and each `include:` then costs whatever *its* record costs. Three vendor includes that each pull in two more is nine lookups from a record that looks like it has three. `ip4:` and `ip6:` are free, which is why flattening a record into raw addresses fixes the error — at the cost of having to re-flatten whenever a vendor changes their ranges.
The qualifier on `all` decides what happens to mail from an unlisted server. `-all` is a hard fail, `~all` a soft fail that asks the receiver to accept the message and mark it. In our scan of the top 10,000 domains, only 44.7% of mail-carrying domains ended their record with `-all`.
That difference matters less than it appears, because DMARC largely supersedes it. Once a domain publishes `p=reject`, a receiver rejects on SPF failure regardless of whether the record said `-all` or `~all`. The qualifier still governs the minority of receivers that check SPF without DMARC — so `-all` is the right answer, but it is not where most of your protection comes from.
Frequently asked questions
- What does the SPF record define?
- SPF lists the hosts and networks authorized to send email on behalf of a domain. Receivers use it to detect forged senders.
- What does ~all versus -all mean?
- The all mechanism sets the default policy: ~all is a soft fail (mark as suspicious) while -all is a hard fail (reject unauthorized senders).
- Why does the SPF lookup limit matter?
- SPF allows at most ten DNS-querying mechanisms during evaluation; exceeding this causes a permerror and the policy may be ignored.