Free email-authentication toolkit
Enter any domain to fetch its live SPF record over DNS-over-HTTPS. We recursively follow every include: and count your total DNS lookups — so you know instantly whether you're under the 10-lookup limit. No signup, no backend: everything runs right here in your browser.
Enter a domain to fetch its v=spf1 TXT record, recursively resolve all includes, and get a plain-English breakdown of every mechanism.
The basics, briefly
SPF (Sender Policy Framework) is a DNS TXT record that lists every server authorised to send email on behalf of your domain. When a receiving mail server gets a message, it checks the sending IP against your SPF record. If the IP isn't listed, the message fails SPF — which counts against DMARC alignment. Use the checker above to see your current record instantly. Learn more in our What is SPF? guide.
The SPF specification (RFC 7208) caps the number of DNS lookups any SPF evaluation may trigger at 10. Each include:, a, mx, ptr, exists: and redirect= mechanism counts as one lookup — and includes can nest further lookups inside them. Exceed 10 and receivers return permerror, which causes SPF to fail permanently. This checker recursively resolves all includes so you always see your real total.
The all mechanism at the end of your record sets the default action for unlisted senders. ~all (softfail) accepts the message but marks it as suspicious — a safe default while you're setting up. -all (hardfail) rejects it outright, which gives the strongest protection once all your legitimate senders are listed. Avoid +all — it authorises every server on the internet.