Enter a domain to fetch its SPF record over secure DNS, expand every include and redirect, and count the DNS lookups against the limit of 10. You can also test whether a sending IP address is allowed.
Last updated:
Enter a domain and click Check SPF to validate its SPF record.
Include tree
Test a sending IP
Authorized IP ranges
Advertisement
Advertisement
How to use the SPF Record Checker
Type a domain such as example.com, or paste an email address: the domain is taken from it.
Click Check SPF. The record is fetched and every include is expanded in a tree.
Read the summary: the total DNS lookup count must stay at 10 or below and the record must have no errors.
Test a sender: enter an IP address from a message's Received header to see whether SPF would pass, and which term matched.
Fix problems with the SPF Record Generator, then check again (DNS caches may need up to the record's TTL).
SPF results explained
Result
Meaning
What receivers usually do
pass
The sending IP is authorized by the domain
Accept; counts toward DMARC if the domain aligns
fail
Matched -all or another - term: not authorized
Reject or mark as spam, depending on DMARC and local policy
softfail
Matched ~all: probably not authorized
Accept but treat as suspicious
neutral
Matched ?all, or nothing matched and there is no all
Treated like no SPF
none
The domain has no SPF record
No SPF signal; DMARC depends on DKIM alone
permerror
The record is broken: syntax error, two SPF records, more than 10 lookups, more than 2 void lookups
Usually treated as a failure; DMARC cannot pass via SPF
temperror
A DNS lookup timed out or failed
Defer and retry later
How the lookup count works
Every include, a, mx, ptr and exists mechanism and the redirect modifier costs one DNS lookup, and the count continues inside every included record. The tree above numbers each lookup in evaluation order, so you can see exactly which service pushes the total over 10. ip4, ip6 and all are free. The address lookups that an mx term needs for its mail hosts do not count toward the 10, but an mx term may return at most 10 hosts.
Common SPF problems and fixes
Two SPF records: merge them into one. Keep a single TXT record that starts with v=spf1.
Too many lookups: remove providers you no longer use, replace a/mx with IP ranges, or move marketing mail to a subdomain with its own record.
Include of a domain without SPF: the provider changed its include value; check its current documentation.
Typos:ipv4:, include=, a missing colon or a stray quote all cause permerror.
+all: allows the whole internet to send as you. Replace it with ~all or -all.
It fetches the domain's TXT records, finds the one starting with v=spf1, checks its syntax and recursively fetches every include and redirect. It reports the total DNS lookup count, void lookups, duplicate SPF records, loops and risky settings such as +all or ptr.
What does 'too many DNS lookups' mean?
RFC 7208 allows at most 10 DNS-querying terms (include, a, mx, ptr, exists and redirect) across the whole SPF evaluation, including nested includes. Above 10, receivers return permerror and SPF fails for all mail, which can also make DMARC fail.
What is a void lookup?
A void lookup is a DNS query made during SPF evaluation that returns no records or a non-existent domain. RFC 7208 recommends failing after 2 void lookups, so stale includes or a/mx terms pointing at missing hosts can break SPF.
Why does my domain show two SPF records?
Someone added a new v=spf1 TXT record without removing the old one, often when switching providers. With more than one SPF record, SPF evaluation returns permerror. Merge them into a single record.
Is the IP test the same as a real SPF check?
It follows the RFC 7208 evaluation order using live DNS answers: ip4, ip6, a, mx, include, exists and redirect are evaluated. Terms with macros (such as %{i}) and the deprecated ptr mechanism are reported but not evaluated, so results for records using them can differ from a real receiver.
Does this tool send my data anywhere?
Only DNS queries for the domain names in the SPF tree are sent, directly from your browser to Cloudflare's or Google's public DNS-over-HTTPS resolver. FreeToolCabin has no server involved and does not log what you check.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.