---
title: "Free SPF checker and SPF record generator"
description: "Check any domain's SPF record for errors, count its DNS lookups against the limit of 10, and build a correct SPF record for Google Workspace, Microsoft 365 and more."
canonical_url: "https://dnsense.io/spf-checker"
---

> Index of every page on this site: [llms.txt](https://dnsense.io/llms.txt)

<key-visual-subpage ctaHref="/spf-checker#builder" ctaIcon="ArrowDown" ctaLabel="Build an SPF record" description="Look up the SPF record of any domain, see every include it follows and whether it stays within the 10 DNS lookups that receivers allow. Then build a clean record for the services that send your mail." highlight="SPF checker" imageAlt="Screenshot of TXT records in the DNSense DNS manager" imageUrl="spf-checker-hero.webp" title="SPF checker and record builder">



</key-visual-subpage>

<spf-tools decorativeShape="bottom-left-small" highlight="SPF record" label="Free SPF tools" title="Check or build an SPF record">



</spf-tools>

<text-content highlight="How SPF works" label="Guide" title="How SPF works and how to read a record">

SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send mail for your domain. A receiving server looks up the record for the domain in the envelope sender, compares the connecting IP address with it and decides to accept, flag or reject the message. Without SPF, anyone can send mail that appears to come from you. SPF is also one of the checks behind DMARC, which large mailbox providers now expect from every sender.

A record is a list of terms, read from left to right. The first term that matches the sending server decides the result.

<table>
<thead>
  <tr>
    <th>
      Term
    </th>
    
    <th>
      Meaning
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        v=spf1
      </code>
    </td>
    
    <td>
      Marks the record as SPF. It always comes first.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        ip4:203.0.113.5
      </code>
      
      , <code>
        ip6:2001:db8::/32
      </code>
    </td>
    
    <td>
      Allows an IP address or a range. Costs no DNS lookup.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        include:_spf.google.com
      </code>
    </td>
    
    <td>
      Also allows everything the other domain's SPF record allows. Costs a lookup, plus the lookups inside it.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        mx
      </code>
      
      , <code>
        a
      </code>
    </td>
    
    <td>
      Allows the servers in your MX records, or the address your domain points to. One lookup each.
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        ~all
      </code>
    </td>
    
    <td>
      Softfail: other senders are suspicious. Use <code>
        -all
      </code>
      
       to reject them.
    </td>
  </tr>
</tbody>
</table>

SPF is stored as a [TXT record](https://dnsense.io/learn/txt-records-explained) at the root of your domain. With DNSense you can edit it at any provider from one table, and keep a [backup of the zone](https://dnsense.io/dns-backup) before you change it.

</text-content>

<feature-grid :cards="[{"title":"Over 10 DNS lookups","titleIcon":"Server","description":"Every include, a, mx, ptr, exists and redirect counts, also inside included records. Over 10 is a permanent error. Drop unused services or swap an include for its ip4 and ip6 ranges."},{"title":"Two SPF records","titleIcon":"Copy","description":"A domain may have only one TXT record starting with v=spf1. Merge them into one."},{"title":"+all or ?all","titleIcon":"LockKeyhole","description":"Both let anyone send as your domain. End the record with ~all or -all."},{"title":"A typo in an include","titleIcon":"Search","description":"An include that points to a name without an SPF record is a permanent error for the whole record."},{"title":"A forgotten sender","titleIcon":"Mail","description":"With -all, a newsletter tool or invoicing system that is not listed has its mail rejected. Start with ~all, review your DMARC reports, then tighten."},{"title":"Lookups that return nothing","titleIcon":"CircleX","description":"More than 2 void lookups is also an error. Remove the a, mx or exists terms that point to names without records."}]" description="Most failed SPF checks come down to one of these." highlight="break mail" label="Pitfalls" title="Six SPF mistakes that break mail">



</feature-grid>

<faq :faqs="[{"question":"What is an SPF record?","answer":"An SPF record is a DNS TXT record that lists the mail servers and services allowed to send email for your domain. Receiving servers check it to decide whether a message really comes from you."},{"question":"How do I check my SPF record?","answer":"Enter your domain in the checker. It reads the TXT record from DNS, follows every include, counts the DNS lookups and lists errors and warnings, with a fix for each."},{"question":"What does too many DNS lookups mean in SPF?","answer":"SPF allows 10 DNS lookups per check, counting every include, a, mx, ptr, exists and redirect, also inside included records. Over 10, receivers return a permanent error and your mail can fail authentication."},{"question":"What is the difference between ~all and -all?","answer":"The term ~all (softfail) tells receivers that other senders are suspicious but may still be accepted. The term -all (fail) tells them to reject mail from anyone not listed. Start with ~all and move to -all when every sender is listed."},{"question":"Can a domain have more than one SPF record?","answer":"No. Two TXT records starting with v=spf1 cause a permanent error. Combine all senders into a single record."},{"question":"How do I add an SPF record?","answer":"Create a TXT record on the root of your domain (name @) with the record as its value. Replace an existing SPF record instead of adding a second one. Changes show up after the TTL of the old record has passed."},{"question":"Does SPF stop email spoofing on its own?","answer":"Not fully. SPF checks the envelope sender, not the From address people see. Combine it with DKIM and a DMARC policy to protect the visible From address too."},{"question":"Do you store the domains I check?","answer":"No. The checker looks up public DNS records for the domain you enter and shows the result. The builder runs in your browser."}]" decorativeShape="top-right-small" label="Questions" title="Frequently asked questions about SPF">



</faq>

## Sitemap

See the full [sitemap](https://dnsense.io/sitemap.md) for all pages.