Free tool

SPF record checker

Enter a domain to read its SPF record, follow every include, count the DNS lookups and see what would make SPF fail.

Free, no signup. The lookup runs in your browser through public DNS resolvers (Cloudflare 1.1.1.1, Google as a fallback); Skrap.ai doesn't receive the domain.

What SPF does

SPF (Sender Policy Framework, RFC 7208) is a TXT record that lists the servers allowed to send email for a domain. Receivers compare the sending server's IP with the list; DMARC then uses the result to decide whether to deliver, quarantine or reject a message.

The checks this tool runs

  • Exactly one record. Two v=spf1 records make SPF fail with a permanent error. Merge them.
  • 10 DNS lookups at most. include:, a, mx, ptr, exists and redirect= each cost one, including those inside every include. Past 10, SPF fails. The tool follows each include and adds them up.
  • How it ends. -all (reject others) and ~all (soft fail) protect the domain; ?all says nothing; +all lets anyone send as you.
  • Deprecated or broken parts. ptr, terms placed after all, and includes that point at domains with no SPF record.
EndingMeaningUse it when
-allHard fail: servers not listed are not allowedYou know every service that sends as the domain
~allSoft fail: not listed, accept but markMost domains; let DMARC enforce
?allNeutral: no statementRarely useful
+allAnyone may sendNever

Frequently asked questions

What is the SPF 10 lookup limit?

Evaluating an SPF record may trigger at most 10 DNS lookups (include, a, mx, ptr, exists, redirect), counting every nested include. Above 10, receivers return permerror and SPF fails for every message.

Should I use ~all or -all?

~all (soft fail) is the common choice: unlisted servers are marked, and your DMARC policy decides what happens. -all is stricter; use it once you're sure every sending service is listed.

Can a domain have two SPF records?

No. With more than one v=spf1 record, receivers return a permanent error and SPF fails. Merge all sources into one record.

Is SPF enough to stop spoofing?

No. SPF checks the envelope sender, not the From address people see. Add DKIM and a DMARC policy; check yours with the DMARC checker.

Free tools

More free tools

Your Next Customer Is JustOne Search Away

Get StartedPricing Plans
No credit card required100 one-time free credits