Free SPF Checker: Look Up and Test Your Domain's SPF Record
Enter your domain and we read its live SPF record from DNS. You see the record, how many exist, your include: senders, lookup count and all policy.
Free with a Brainito account. No credit card required.
example.com
ExampleSPF is configured for example.com with a ~all policy.
- SPF recordv=spf1 include:… mx ~all
- Number of SPF records1
- Authorized senders (include:)mail.example.net
- DNS lookups (include/a/mx/exists/redirect)2
- All mechanism~all
Example result with sample data. Yours uses live data for your inputs.
How it works
From your input to a prioritised list of fixes in under a minute.
- Step 1
Enter your details
Your website, business or the item you want checked. Nothing to install.
- Step 2
We run live checks
Brainito fetches live data and tests it against the rules that matter.
- Step 3
Fix what matters first
Clear results with what to fix, in order of impact, and where to go next.
What you get
What the result tells you, and why it is worth the minute it takes.
Live DNS Lookup
Reads the SPF record straight from DNS, the same record receiving servers see, so you never copy and paste it by hand.
Policy and Record Count
Flags duplicate SPF records and grades the all mechanism, from ~all and -all down to the risky ?all and +all.
Senders and Lookups Listed
Lists every include: domain your record authorises and counts the lookup terms in it against the limit of 10.
The guide
What the spf checker does, how to use it, and what to do with the result.
An SPF checker looks up the SPF record your domain publishes in DNS and tells you whether it is set up correctly. Enter a domain, with no need to copy the record from your DNS provider. Our checker reads the live TXT records, finds the one that starts with v=spf1 and reports five things: the record itself, how many SPF records exist, the include: senders it authorises, how many DNS lookup terms it contains, and whether it ends in ~all, -all, ?all or +all. Each problem comes with a plain fix.
How to Check Your SPF Record for a Domain
Type the domain you send email from, such as example.com. You can paste a full URL instead, since the checker strips https://, www and any path. It then queries DNS for that domain's TXT records, the same records receiving mail servers read, and keeps the ones that begin with v=spf1. If none exist, you get a single row, SPF record: Missing, with an example record to publish. If the DNS lookup itself fails, the result says Lookup failed rather than giving a false verdict. Check every subdomain you send from separately, such as mail.example.com, because each name carries its own record. After you edit DNS, allow time for the change to spread, and note that results for the same domain are saved for up to seven days.
How to Read Your SPF Check Results
SPF record shows the record text, up to 160 characters. Number of SPF records should be 1. Two or more is marked as a fail, because receivers treat multiple records as a permanent error and may ignore all of them. Authorized senders (include:) lists the domains your record pulls in, usually your mailbox provider plus any newsletter or billing platform. DNS lookups counts the include, a, mx, exists and redirect terms written in your record and fails above 10. All mechanism shows the closing rule: ~all and -all pass, ?all warns because it offers no protection, +all fails, and a missing all term warns. The banner at the top sums it up, for example SPF is configured for example.com with a ~all policy.
SPF Record Format: v=spf1, include:, ~all and -all
Every SPF record starts with v=spf1, the version tag. Mechanisms follow and are read left to right. include:mail.example.net hands part of the decision to another domain's SPF record, which is how you authorise a mail service. ip4: and ip6: list specific server addresses, while a and mx authorise the servers behind your own A or MX records. The record ends with an all term that says what happens to every other sender. ~all is a soft fail: unlisted senders are marked as suspicious but often still delivered. -all is a hard fail: unlisted senders should be rejected. ?all is neutral, and +all lets anyone send as you. So v=spf1 include:mail.example.net ip4:203.0.113.5 ~all lets one service and one server send, and soft fails the rest.
The SPF 10 DNS Lookup Limit Explained
Receivers stop evaluating SPF after 10 DNS lookups and return a permanent error, which means the check fails even for your genuine mail. The terms that cost a lookup include include, a, mx, exists and redirect; ip4 and ip6 do not. Our checker counts the lookup terms written directly in your record. It does not open each include to count the lookups inside it, and many mail services nest further includes, so treat the number as a minimum rather than the full total. If you are close to the limit, remove includes for services you no longer use, replace a or mx with ip4 ranges when your servers are fixed, and ask each provider for its leanest include. To audit a record you paste in, with an estimate of nested lookups, use our SPF Record Checker.
Common SPF Errors and How to Fix Them
Publishing two SPF records is a frequent mistake, often created when a new email service asks you to add its own record. Merge them into one TXT record that holds every include, then delete the extra. A missing record means receivers cannot tell who may send for you, so publish one that starts with v=spf1, lists your sending services and ends with ~all. A record ending in +all or ?all gives spoofers an open door: tighten it to ~all, and move to -all once you are sure every real sender is listed. Forgetting a service is the quiet failure. If your newsletter or invoicing tool sends as your domain but is not included, its mail fails SPF. Compare the Authorized senders row with the tools you actually use.
SPF, DKIM and DMARC: What to Check Next
SPF is one of three DNS records that prove your mail is genuine. DKIM adds a cryptographic signature to each message, and DMARC tells receivers what to do when checks fail and where to send reports. SPF on its own does not protect the From address people see in their inbox; DMARC builds on SPF and DKIM to do that. Once your SPF check passes, run the DKIM Checker and the DMARC Checker on the same domain and fix any gaps. Then check SPF again whenever you add or drop an email service, switch mailbox provider or edit DNS, because those are the moments a working record most often breaks without anyone noticing until mail starts landing in spam.
Frequently asked questions
Something else? Email support@brainito.com
How do I check my SPF record?
Enter your domain, such as example.com, in the SPF checker. It reads your live DNS and shows the SPF record, how many SPF records exist, the include: senders, the lookup count and the all policy, with a fix for each problem.
Is the SPF checker free?
Yes. The SPF checker is free with a Brainito account and uses 0 credits per check. It reads your live DNS records, so there is nothing to install and no record to copy and paste.
What is the difference between ~all and -all in SPF?
~all is a soft fail: mail from unlisted servers is marked as suspicious but usually still delivered. -all is a hard fail: receivers are told to reject it. Start with ~all, then move to -all once every sender you use is listed.
Can a domain have two SPF records?
No. A domain must publish exactly one TXT record starting with v=spf1. Two or more causes a permanent error, and receivers may ignore all of them. Merge every include and ip4 entry into one record and delete the rest.
Does the SPF checker count nested include lookups?
No. It counts the lookup terms written in your own record: include, a, mx, exists and redirect. Includes often contain more lookups of their own, so your real total can be higher. The SPF Record Checker estimates nested lookups for a record you paste in.
Can I test whether a specific IP address passes SPF?
Not directly. The checker reads and grades the record but does not simulate a message from a given IP. You can confirm an address is listed by reading the SPF record row for ip4: or ip6: entries, or an include from that server's provider.
Where to go from here
The spf checker answers one question. These are the next ones worth asking.
Know in seconds if your SPF record is set up right
One account unlocks the spf checker plus 320+ marketing tools, weekly audits and your action plan.
- Free with a Brainito account
- No credit card required