MailPosture
Free tool

Free SPF Checker

SPF is a DNS record that lists the mail servers allowed to send email as your domain. Enter a domain to check its SPF record for common, deliverability-breaking mistakes.

How it works

1

We look up your domain's TXT records and find any that start with `v=spf1`.

2

We check its `all` mechanism, lookups, and any redirect — the things that break SPF.

3

We show whether it passes, warns (soft fail), or fails, plus the raw record to copy.

Common SPF errors

  • No SPF record at all — mail from your domain is unverified and more likely to be flagged.
  • `+all` — this lets ANY server send as you. It's a critical misconfiguration.
  • More than 10 DNS lookups — receiving servers reject the record as invalid.
  • `~all` (soft fail) instead of `-all` (hard fail) — weaker protection.
  • No `all` mechanism at the end — SPF should end with `-all` or `~all`.

Frequently asked questions

What does an SPF 'pass' mean?

It means your domain publishes a valid SPF record that ends with an enforcing `all` mechanism (ideally `-all`) and stays under the 10-lookup limit. Authorized senders are listed; everyone else is told to fail.

My SPF says `~all` (soft fail). Is that bad?

It works but is weaker than `-all` (hard fail). With `~all`, unauthorized mail is marked but usually still delivered. `-all` tells receiving servers to reject it outright — the recommended setting once you've confirmed all your legitimate senders are listed.

How many lookup limits matter?

RFC 7208 caps SPF at 10 DNS lookups (from `include`, `a`, `mx`, `redirect`, etc.). Over the limit, receiving servers treat the record as invalid and may reject your mail. Reduce `include:` chains or consolidate providers to stay under 10.

Keep this record healthy 24/7

A single check only tells you how your SPF looks right now. Sign up for continuous monitoring and get alerted the moment your records change or break.

Start free monitoring