SPF record lookup.

Fetch a domain's SPF TXT record, list the authorized senders, and see whether the policy ends in -all or ~all.

Price
Free, no signup
Try
SPF record lookupWaiting for input

SPF record appears here.

Raw record, authorized senders, and the all policy.

What this tool checks.

It looks up the v=spf1 TXT record for a domain, parses the mechanisms, and reports the all policy.

  • Whether a v=spf1 record exists
  • Authorized senders such as include, ip4, ip6, a, and mx
  • Policy strength with -all or ~all

How to read the results.

Use the raw record to match provider docs, then scan the mechanism list for missing senders.

  • Every sending platform should appear in the mechanisms list.
  • Prefer -all once the list is complete. Soft fail (~all) marks others as suspicious.
  • Too many include hops can hit the 10 DNS lookup limit. Use the SPF limit tester to count them.

SPF record syntax.

SPF tells receivers which hosts may send mail for your domain. Mail from an unlisted host is marked or rejected, depending on the all mechanism.

  • v=spf1 identifies the record
  • include: lets another service send for you, such as include:_spf.google.com
  • mx and a allow your mail and website hosts
  • ip4 and ip6 list specific addresses
  • -all rejects everyone else. ~all is a soft fail. ?all is neutral

Common questions.

What is an SPF record?
It is a DNS TXT record that lists the servers allowed to send email for your domain.
Why does SPF use -all?
The -all mechanism tells receivers to reject mail from servers not listed in the record.
Can SPF have too many lookups?
Yes. SPF is limited to 10 DNS lookups, so too many include statements can cause it to fail.
Does SPF protect subdomains?
Not automatically. Subdomains need their own SPF records unless you set one for them.

Send from a domain inboxes trust.

Authentication setup and reputation monitoring are part of Bento, not an add-on. Plans start at $29/mo for up to 5,000 Active Users.