SPF Record Checker

Analyze SPF records for email authentication

SPF Record

Enter an SPF record to analyze (usually found in DNS TXT records)

Status

Valid

DNS Lookups

1 / 10

Mechanisms

Parsed Mechanisms

Qualifier	Type	Value	Result
+ Pass	include	_spf.google.com	Allow (default if no qualifier)
~ SoftFail	all	-	Accept but mark suspicious

SPF Mechanisms Reference

Mechanism	Description
all	Match all senders
ip4	Match IPv4 address or range
ip6	Match IPv6 address or range
a	Match A record of domain
mx	Match MX record of domain
ptr	Match PTR record (deprecated)
exists	Match if domain has A record
include	Include another domain's SPF
redirect	Use another domain's SPF entirely

How to use SPF Record Checker

1Enter your domain name to query its published SPF DNS record.
2Enter the mail servers or include mechanisms you expect to see.
3Read the resolved SPF policy and whether it passes or has too many DNS lookups.

SPF = 'v=spf1 include:_spf.a include:_spf.b -all' (max 10 DNS-lookup mechanisms)

SPF tells receiving mail servers which IPs may send mail for your domain; a missing or broken record lets attackers spoof your address.

SPF allows at most 10 DNS lookups across all include mechanisms, so over-nesting includes causes permerror and mail may be rejected.

What does -all mean?

A hard fail: reject mail from sources not in the policy. ~all is softfail, more permissive.

Why the 10-lookup limit?

To bound DNS query load; exceeding it yields permerror and receivers may reject.

Can SPF alone stop spoofing?

No, pair it with DKIM and DMARC for real protection and reporting.

Encode and decode URLs and special characters

Generate Content Security Policy headers

Check HTTP redirect chains and status codes

Analyze SPF records for email authentication