Free tool · SPF checker
Who is allowed to sendemail as your domain?
Read your SPF record, see every service it allows, and count its DNS lookups against the limit of 10. Free, no sign-up.
We log the domain you check to keep this tool working and see which tools are worth building. See our Privacy Policy.
What we check in your SPF record
One record
A domain can have only one TXT record that starts with v=spf1. Two or more and receivers treat SPF as broken.
Ten lookups
Every include:, a, mx and redirect costs a DNS lookup, and so do the includes inside them. More than 10 and SPF fails.
The ending
The record should end in ~all or -all. +all lets anyone send as you; ?all, or no ending at all, means unknown senders are not flagged.
Frequently asked questions
What does "too many DNS lookups" mean?
Receivers stop evaluating SPF after 10 DNS lookups and treat the result as a failure. Each email service you add with include: uses at least one lookup, and often several more inside it. Remove services you no longer use, or ask a provider for its IP ranges so you can list them with ip4: instead.
Should my SPF record end in ~all or -all?
Both tell receivers that unlisted senders are not authorised. ~all asks them to treat that mail as suspicious, -all asks them to reject it. Start with ~all while you confirm every real sender is listed, then move to -all if you want the strictest setting. DMARC then decides what actually happens.
What is a void lookup?
An include: that points to a name with no SPF record, often left behind after you stop using a service. Receivers allow two before failing SPF, so it is worth removing them.
My domain sends no email. What should SPF say?
Exactly v=spf1 -all. That tells every receiver no server may send as your domain. Pair it with a DMARC record of v=DMARC1; p=reject; so spoofed mail is turned away.
More free email tools
Email security check
SPF, DKIM, DMARC, MTA-STS, TLS reporting, BIMI and DNSSEC in one check, with a grade.
DMARC checker
See whether spoofed mail is blocked, and where your reports go.
DMARC record generator
Build a DMARC record step by step, starting safely in monitoring mode.
MTA-STS checker
Check that mail sent to you must arrive encrypted, and that your policy file works.
Hear about it the day your email setup changes
Domain Lab checks SPF, DKIM, DMARC, MTA-STS, TLS reporting, BIMI and DNSSEC every day, alongside registration, DNS and SSL, and tells you what changed and how to fix it. Free for your first domain.
Start monitoring free