SPF record checker
Enter a domain to read its SPF record, follow every include, and count the DNS lookups receivers will make. Each problem comes with the change that fixes it.
How to read the result
Record is the TXT record exactly as published. DNS lookups is what it costs a receiver: up to 7 is comfortable, 8–10 leaves no room for the next service, above 10 SPF fails for all mail. Include chain shows where the lookups come from: every include can pull in more.
The ending matters: -all and ~all are fine, ?all protects almost nothing, +all lets anyone send as you. A record with no all at all gives unlisted servers a neutral result.
SPF alone does not stop spoofing of the From address people see; DMARC does. Check it next with the DMARC checker, or run the whole domain health check.
Questions
- What is the SPF 10 DNS lookup limit?
- Receivers stop evaluating SPF after 10 DNS lookups. include, a, mx, ptr, exists and redirect each cost one, and the includes inside an include count too. Past 10, SPF fails with a permanent error for every message, even from servers that are listed.
- Can a domain have two SPF records?
- No. With more than one v=spf1 record, SPF fails for all mail (permerror). When you add a new sending service, add its include to the existing record instead of creating a second one.
- Should I use ~all or -all?
- ~all (soft fail) is the safe default while you are still finding every service that sends for you. -all (fail) is stricter. With DMARC at quarantine or reject the difference matters little, because DMARC decides what happens to failing mail. Never use +all.
- Which SPF include do Resend and Amazon SES use?
- Amazon SES uses include:amazonses.com, and Resend sends through SES, so its records use the same include, usually on a sending subdomain such as send.yourdomain.com. Postmark is include:spf.mtasv.net. Your provider's domain settings show the exact record.
More free tools
No sign-up, nothing stored. All tools.
Domain email health check
SPF, DMARC, MX and blocklists for a domain in one report, with what to fix first.
DMARC checker
Reads the DMARC policy, report addresses and alignment, and says what the policy actually does to spoofed mail.
DKIM checker
Reads a DKIM key by selector, or searches the common ones, and checks its type and length.
MX lookup
The mail servers of a domain, their addresses and who hosts the mailboxes.
Blocklist checker
A domain and its mail servers against public DNS blocklists.
Email provider lookup
Which mailbox provider and which sending services a domain uses.
Email address verifier
Format, mail servers, throwaway domains, role addresses and typos for one address.
Bulk email checker
Up to 100 addresses from a pasted list or a CSV, with a CSV of the results. Nothing stored.
Disposable email checker
Whether an address or domain belongs to a throwaway-mail service.
Email HTML preview
Paste email HTML, see it on desktop and phone with images on or off, and what breaks in Gmail and Outlook.
Merge tag tester
A template with {{tags}} and JSON data in, the email out, with every tag that would reach the recipient unfilled.
Subject line checker
How a subject and preheader look in iPhone Mail and Gmail, where phones cut them, and what reads like a pitch.