BlueFox Email

Appearance

←Back to deliverability Tools

Free SPF Checker ​

Validate your SPF records and ensure your domain's email authentication is properly configured with our comprehensive SPF checker tool.

What This Tool Checks ​

Enter a domain, and the checker fetches its SPF TXT record and evaluates it for common problems:

  • Whether an SPF record exists.
  • The enforcement qualifier on all: hard fail (-all), soft fail (~all), neutral (?all), or allow all (+all).
  • The total number of DNS lookups the record triggers, checked against the RFC 7208 limit of 10.
  • Every mechanism in the record (include, a, mx, ip4, ip6, redirect) and whether each one costs a DNS lookup.
  • Optionally, whether a specific IP address you supply would pass or fail the record.

How to Use It ​

  1. Enter your domain and click Check SPF.
  2. Review the signals: Policy shows the all qualifier, DNS Lookups shows how many of the 10 allowed lookups the record uses, and Mechanisms lists the total count.
  3. Click any include: mechanism to check that included domain's own SPF record directly, useful for tracing where your lookup budget is being spent.
  4. Optionally expand Test a specific IP against this record to check whether a given sending IP would pass.
  5. Expand Raw SPF record for the exact TXT record, or Mailauth validation for a detailed pass/fail breakdown.

Why the 10-Lookup Limit Matters ​

RFC 7208 caps SPF evaluation at 10 DNS lookups. Mechanisms like include, a, mx, redirect, and exists each count toward that limit, while ip4 and ip6 don't. Exceeding 10 lookups causes receiving servers to return a permerror, which many mail providers treat as an SPF failure regardless of what the record actually authorizes. This is the most common way otherwise correct SPF records silently break, usually after adding one too many third-party include statements.

Example SPF Record ​

v=spf1 ip4:203.0.113.0/24 include:_spf.google.com -all

This authorizes the IP range 203.0.113.0/24, includes Google Workspace's sending servers, and hard-fails anything else, meaning unauthorized senders should be rejected outright.

Frequently Asked Questions ​

What's the difference between hard fail and soft fail? ​

-all (hard fail) tells receiving servers to reject mail from unlisted sources. ~all (soft fail) asks them to accept it but mark it as suspicious. Most domains move from ~all to -all once they've confirmed all legitimate senders are covered.

Can a domain have more than one SPF record? ​

No. A domain should publish exactly one SPF TXT record. Multiple SPF records at the same domain cause a permerror during evaluation, which typically fails the check entirely, even if one of the records would have passed on its own.

Why does the tool flag my record even though it looks fine? ​

The most common cause is exceeding the 10-lookup limit, often from nesting several include mechanisms (like an ESP that itself includes other providers). Use the mechanism list to trace which include is adding the most lookups.

Does SPF alone stop spoofing? ​

Not completely. SPF validates the return-path address, not the visible "From" address recipients see. Pairing SPF with DKIM and DMARC closes that gap.