Is Your SPF Record Actually Enforcing?

Check your SPF record

Enter a domain below. The checker reads the live TXT records at the domain apex over encrypted DNS and tells you whether the SPF record parses cleanly — version tag, 10-lookup-limit count, multiple-record errors, and the closing qualifier.

Record broken or missing? Have a specialist double-check it — the $49 Email Domain Trust Audit is a fixed-output report with risk notes and prioritized next steps.

What the checker looks for

1. A TXT record at the domain apex (for example example.com) — not at a prefixed hostname like _spf.example.com. SPF lives at the root.
2. The v=spf1 version tag as the first term — a record that doesn't start with it is ignored by senders.
3. Exactly one SPF record — two or more v=spf1 records are a permanent error per RFC 7208.
4. The 10-DNS-lookup limit — include:, a, mx, ptr, exists:, and redirect= terms are counted; over 10 means senders permerror the record.
5. The closing qualifier — -all enforces, ~all soft-fails while testing, +all defeats the whole record.

No record found?

Build one in seconds with the Free SPF Record Generator — list your mail servers and it writes a valid v=spf1 record for you. Publish the TXT record at your domain root and re-run this checker after DNS propagates.

SPF is one leg of the stool — it says nothing about alignment or signing. Run the Free Email Domain Trust Checker to see where your domain stands on the full authentication set.

Verify the rest of the set

SPF is the sending-identity leg. Generate or verify the rest of the authentication set, free, in your browser:

• Free DKIM Record Generator
• Free DKIM Record Checker
• Free DMARC Record Generator
• Free DMARC Record Checker
• Free BIMI Record Generator
• Free BIMI Record Checker
• Free MTA-STS Record Generator
• Free TLS-RPT Record Checker
• Free MX Record Checker
• Free Email Domain Trust Checker
• Free Email Header Analyzer

Prefer done-for-you?

If you'd rather hand this to a specialist, submit your domain for the Email Domain Trust Audit — a fixed-output report with risk notes and prioritized next steps. When records are broken and you want them fixed, the 99 Mailbox Rescue gets them fixed within 48 hours, zero tech touch.

Frequently asked questions

What does the SPF checker look up? The checker queries the live TXT records at your domain's apex over DNS (via encrypted DNS-over-HTTPS), finds the record starting with v=spf1, and reports whether the version tag is valid, how many DNS-querying terms it uses against the 10-lookup limit, whether more than one SPF record exists (a permerror), and what closing qualifier the record ends with.

What is the 10-DNS-lookup limit? RFC 7208 caps the DNS-querying terms in an SPF evaluation at 10: include:, a, mx, ptr, exists:, and redirect= each cost at least one lookup. Exceed it and senders return a permanent error — the whole record is treated as broken. The dangerous part is nesting: an include: can hide further lookups inside the included record, which is how most domains blow the limit.

Why is more than one SPF record a problem? RFC 7208 requires exactly one v=spf1 record per domain. When senders find two or more, they return a permerror and fail the SPF check entirely — even if one of the records was perfect. Fix it by merging everything into a single v=spf1 record and deleting the extras.

Should my SPF record end with -all or ~all? -all hard-fails mail from servers your record does not authorize — the strongest setting, and the right one once you are confident the record covers every sender. ~all is softfail: failures get marked but delivered, which is safer while you are still validating. +all passes mail from everyone and defeats SPF entirely; never ship it.

No record found — what do I do? Publish one: use the free SPF record generator to build a v=spf1 TXT record listing your mail servers, publish it as a TXT record at your domain root, and re-run the checker after DNS propagates (minutes to hours). Keep exactly one record and end it with -all once you trust it.