- Live SPF lookup
- RFC 7208 validation
- Lookup count against the 10 limit
SPF Checker
Use LeadCanal's SPF Record Checker to find out which email providers are authorized to send on behalf of your domain.
Enter a domain name and click "Check SPF Records" to see complete SPF analysis.
Enter a domain and the SPF checker runs a live SPF lookup, validates the record against RFC 7208, counts DNS lookups and lists every issue it finds. Email the report to whoever manages your DNS.
How to check an SPF record
A full SPF record check takes under a minute.
- 1
Enter your domain
Type the domain you send from, such as example.com. Leave out https:// and www.
- 2
Run the SPF lookup
The checker fetches the live TXT record from DNS, so you see what receiving servers see right now.
- 3
Read the lookup count
Each include, a, mx and redirect adds a DNS lookup. Stay at 10 or fewer, or SPF fails for every message.
- 4
Fix and recheck
Correct any flagged issue in your DNS, wait for the TTL to pass, then run the SPF checker again to confirm a pass.
What an SPF record is
SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers allowed to send email for it. When a message arrives, the receiving server checks the sending IP against that list.
If the IP is on the list, SPF passes. If not, the record's ending tells the receiver how strict to be: ~all for a soft fail, -all for a hard fail.
- v=spf1 starts every record
- include: pulls in a provider's servers
- ip4: and ip6: list your own servers
- ~all or -all sets the policy for everything else
Common errors the SPF checker finds, and fixes
These are the issues the SPF checker flags most often, and how to fix each one.
| Issue | Why it breaks SPF | How to fix it |
|---|---|---|
| More than 10 DNS lookups | SPF allows at most 10 lookups. Past that, the result is a permanent error and SPF fails. | Remove unused includes, or replace them with ip4/ip6 ranges. |
| Multiple SPF records | A domain may publish only one SPF record. Two records cause a permanent error. | Merge all mechanisms into a single v=spf1 record. |
| +all at the end | Lets any server on the internet send as your domain. | Change to ~all, or -all once you are sure every sender is listed. |
| Missing sender | A tool that sends for you, like a CRM or helpdesk, is not in the record. | Add that provider's include. |
| Syntax error | A typo, missing space or unknown mechanism invalidates the record. | Rebuild it with the SPF record generator. |
| Deprecated ptr | ptr is slow, unreliable and discouraged by RFC 7208. | Replace with ip4, ip6 or include. |
Why SPF matters for deliverability
Required by Gmail and Yahoo
Since February 2024, bulk senders must pass SPF and DKIM and publish DMARC. Smaller senders need SPF or DKIM at minimum.
Stops spoofing
Without SPF, anyone can send mail that claims to come from your domain.
Feeds DMARC
DMARC passes when SPF or DKIM passes and aligns with your From domain.
How SPF, DKIM and DMARC work together
SPF checks where a message came from. DKIM checks that the message was signed by the domain and not changed on the way. DMARC ties them to the address the reader sees in the From line and tells receivers what to do when both fail.
SPF alone breaks on forwarding, because the forwarding server is not on your list. That is why you need all three. Check SPF here, then run the DKIM checker and DMARC checker, or scan the whole domain at once.
Type your domain into the SPF checker above. It runs a live SPF lookup, shows the record, counts DNS lookups and flags syntax problems. No signup needed.
RFC 7208 caps SPF at 10 DNS lookups per check. Each include, a, mx, exists and redirect counts. Go over and receivers return a permanent error, so your SPF fails even if the sender is listed.
No. A domain must publish exactly one TXT record that starts with v=spf1. Two records cause a permanent error. Combine every provider into one record instead.
Start with ~all (soft fail) while you confirm every sending service is listed. Move to -all once you are sure. Never use +all, which lets anyone send as your domain.
Most DNS changes show within minutes to a few hours, depending on the record's TTL. Run the SPF record checker again after an hour to confirm the new record is live.
Further reading
- RFC 7208: Sender Policy Framework The official SPF specification, including the 10 DNS lookup limit.
- RFC 7489: DMARC The DMARC specification, covering policies, alignment and reports.
- Google email sender guidelines Gmail requirements for authentication, spam rates and unsubscribe links.
SPF errors you would rather not untangle yourself?
Our team fixes SPF, DKIM and DMARC across all your sending domains and confirms everything passes.