SPF record checker

Look up a domain's SPF record, count its DNS lookups against the limit of 10, find includes that no longer exist, and get a fixed record that keeps every sender. Free, no sign-up.

What this SPF check tests

Exactly one SPF record (v=spf1). Two records are a permanent error: receivers treat SPF as broken. The checker merges them into one record that keeps every sender.
The 10-DNS-lookup limit (RFC 7208), counted through every nested include. Over 10, SPF fails with permerror for all your mail, even though the record looks fine.
Includes that point to a domain with no SPF record (a service you stopped using, or a typo).
The ending: +all or ?all protect nothing; ~all and -all are fine.
Your mailbox provider's include is present (Google Workspace, Microsoft 365, Zoho and a dozen more are detected from MX).
Deprecated ptr, duplicate includes, terms after all and records over ~450 bytes.

SPF mechanisms and endings

`ip4: / ip6:`	Allow an IP address or range, e.g. `ip4:203.0.113.10`. No DNS lookup.
`a / mx`	Allow the IPs of the domain's A or MX records. 1 lookup each (mx can add more).
`include:`	Allow everything another domain's SPF allows, e.g. `include:_spf.google.com`. 1 lookup, plus every lookup inside it.
`exists:`	Pass if a DNS name exists. 1 lookup. Rare outside large providers.
`ptr`	Deprecated (RFC 7208): slow and unreliable. Remove it.
`redirect=`	Use another domain's SPF instead of this one. Ignored if the record has an `all`.
`-all`	Fail everything not listed. The strictest ending.
`~all`	Softfail everything not listed. Fine together with DMARC.
`?all`	Neutral: no protection at all.
`+all`	Lets anyone in the world send as you. Never use it.

Common SPF problems

Too many lookups. Each newsletter, CRM and help desk adds an include. Remove services you no longer use, or replace an include with the provider's ip4: ranges when they publish fixed ones.
A second SPF record added by a new service's setup wizard. Merge it into the first.
SPF passes, DMARC still fails. SPF checks the Return-Path (bounce) domain, which is often your email service's domain, not yours. DKIM signed with your domain fixes that.
Bounces: Gmail 550 5.7.27 (SPF failed), 550 5.7.24 (suspicious SPF entries).

What an include actually allows, and how many lookups it costs: SPF include directory. Build a new record with the SPF generator, or check DMARC, DKIM and everything at once on the deliverability checker.

Rather have it fixed for you? I check your domain by hand and email you the exact SPF, DKIM and DMARC records for every service that sends your mail, with click-by-click steps for your DNS host. Then I re-check until they pass.

Get it fixed: $29

Pay by card, no account needed. Within 24 hours; not fixed, full refund. Prefer Fiverr? · Do it yourself with the Fix Kit ($15)

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Did this fix it?