Free SPF record checker

What does this checker look at?

SPF (Sender Policy Framework) is your domain's list of approved email senders. When a message arrives claiming to be from yourbusiness.com, the receiving provider checks this list. Mail from a server that isn't on it is treated as suspicious.

The checker reads the TXT records on your domain and looks for one that starts with v=spf1. Then it checks the record against these rules:

• An SPF record has to exist. Without one, any server can claim to send email as you.
• There must be exactly one. Two or more SPF records break SPF entirely.
• The all at the end tells providers what to do with senders you haven't listed: -all (fail), ~all (soft fail), ?all (neutral, no instruction) or +all (allow everyone).
• The record has to stay within the DNS lookup limit. Each include:, a, mx, ptr, exists or redirect= costs a lookup, and so do the ones inside the services you include. We follow those nested includes and add them up.

Here's what a healthy record looks like for a business on Google Workspace that also sends a newsletter through another service:

How do I read my results?

Configured means you have one SPF record, it ends in -all or ~all, and it stays within 10 DNS lookups. Providers know which servers are yours and that everything else isn't approved.

Partially configured means your record exists, but it ends in ?all or has no all at the end. That leaves providers without instructions for unapproved senders, so your record isn't doing much to stop impersonation. Changing the ending to ~all usually fixes it.

Needs attention means one of these problems was found:

• There's no SPF record, so your domain doesn't list any approved senders and anyone can claim to send email from it.
• There are multiple SPF records. There must be exactly one, and when providers find more, SPF fails with an error and none of them count.
• The record ends in +all, which approves every server in the world to send as you and defeats the point of SPF.
• The record needs more than 10 DNS lookups. The SPF standard caps evaluation at 10. Past that, many providers treat your record as broken, and your real email can fail authentication.

If you see Couldn't check, the DNS lookup didn't finish. That's usually temporary, so try again in a few minutes.

How do I fix common problems?

SPF is a TXT record at your DNS host, usually where you bought your domain. Most fixes take about five minutes.

• With no record, add one TXT record at @ that includes your email provider. Google Workspace uses include:_spf.google.com and Microsoft 365 uses include:spf.protection.outlook.com. Add an include: for any other service that sends email for you, like a newsletter or booking tool, and end with ~all.
• To merge multiple records, copy every include: and ip4: value into one record, save it, then delete the others.
• If the record ends in +all or ?all, edit it and change the ending to ~all. Don't add a second record.
• For too many lookups, remove services you no longer use. Ask any vendor that sends bulk email for you whether it can send from a subdomain like news.yourbusiness.com, which gets its own SPF record and lookup budget.

SPF works best alongside DKIM and DMARC. Our guide to SPF, DKIM and DMARC explained shows how they fit together, and how to stop email spoofing walks through setting up all three. If your team uses Google, the Google Workspace security guide covers the related admin settings. Once SPF passes, check your policy with the free DMARC checker.

Is this check safe to run?

Yes. The SPF checker only reads public DNS records, the same ones every email provider looks up when it receives a message from your domain. It doesn't send email, connect to your mail server or change anything.

Nothing is installed, and you don't need to sign in. Single-check tools like this one don't store the domains you look up. For a saved report that covers SPF alongside the rest of your website and email setup, run the free website security scan.