Free tool
SPF record checker
Look up a domain's SPF record, follow its includes and count its DNS lookups, with a plain explanation of every problem found.
What it checks
What this checker looks at.
- Reads the TXT records at the domain and finds the one that starts with v=spf1. More than one is reported, because receivers treat that as an error.
- Checks the terms against the SPF grammar: mechanism names, ip4 and ip6 addresses, that include and exists name a target, that all takes no argument, and that redirect and exp appear at most once.
- Follows each include and redirect, reads the target's SPF record, and shows the whole chain as a tree.
- Counts the terms that cost a DNS lookup against the limit of 10, and the include and redirect targets that return nothing against the limit of 2. The a and mx terms count toward the limit, but this checker does not resolve them.
- Reports how the record ends. The first all decides, and a followed redirect supplies it when the record has no all of its own.
- It reads TXT records only. It does not expand macros or test a particular sending server's IP address.
Common problems
How to fix what it finds.
Publish exactly one SPF record
Every service you send through belongs in the same record. When a new service gives you its own v=spf1 line, copy its include into your existing record instead of adding a second one.
Stay within 10 lookups
Each include, a, mx, ptr, exists and redirect counts, including the ones inside records you include. Remove services you no longer use, and list fixed addresses with ip4 or ip6, which cost no lookup.
End the record with ~all or -all
Without one, servers you did not list get a neutral result, the same as having no SPF at all. Use ~all while you are still finding every sender, and -all once the list is complete.
Add a sending service before you use it
Mail from a service that is not in the record does not pass SPF for your domain. Add its include or addresses first, run this check, then start sending.
- More than one SPF recordMerge the mechanisms of every SPF record into a single record and delete the others.
- Unknown mechanismCorrect the spelling of the term or remove it. A common cause is a typo such as "inlcude" or a missing colon.
- Invalid IP address or prefixWrite the complete address, and use a prefix length for a range, as in ip4:192.0.2.0/24.
- Unknown modifierIf the term was meant to do something, check its spelling. Otherwise you can remove it.
- More than 10 DNS lookupsRemove includes for services you no longer use, and replace a or mx terms with ip4 or ip6 ranges where the addresses are stable.
- More than 2 empty lookupsRemove the include or redirect terms that point at names with no records.
- Include or redirect target has no SPF recordCheck the target name for typos, and ask the service that gave it to you for the current value. Remove it if you no longer use that service.
- Include or redirect lookup failedRun the check again. If it keeps failing, the name servers for that target are not answering, and the owner of that domain needs to fix them.
- Include loopRemove the include or redirect that points back up the chain.
- Check stopped earlyRun the check again. A record that keeps hitting this has a long include chain, which also brings it close to the 10-lookup limit receivers enforce.
- +all allows every senderEnd the record with ~all or -all instead, after listing the servers that really send your mail.
- ?all gives no answerOnce every sending service is listed in the record, change ?all to ~all or -all.
- No all and no redirectEnd the record with ~all or -all.
- ~all marks other senders as softfailNothing is required. When you are sure every sending service is listed, you can move to -all.
- -all marks other senders as failNothing is required. Before you start sending through a new service, add it to the record.
- redirect is ignoredKeep either the all mechanism or the redirect, not both. Use include if you want another record's servers in addition to your own.
- ptr mechanism in useReplace ptr with ip4, ip6, a or include terms that name the sending servers directly.
- Macros not evaluatedNothing is required if you use macros on purpose. Test the record with a real message to see how receivers evaluate it.
- Syntax errorGive include and exists a domain, as in include:example.com, write all with nothing after it, and keep at most one redirect and one exp.
Try it on the free plan.
1,000 emails a month free, no card. Pro is $29 a month for 50,000.