Free, reads live DNS
SPF record checker
Validate your SPF record and count DNS lookups against the limit of 10 — go over it and SPF silently fails with a PermError.
No SPF record found for
Publish an SPF record so receivers can verify who may send for your domain:
v=spf1 include:amazonses.com ~all
SPF for
Over the limit — SPF evaluates to PermError and is ignored. Flatten includes or remove unused mechanisms.
Policy ends with — .
Lookup-causing mechanisms ()
Direct answer
What is an SPF record?
An SPF record is a DNS TXT record that lists the servers allowed to send email for a domain. It starts with v=spf1. A receiver checks the sending IP against that list. The record may cause at most 10 DNS lookups. The 11th lookup makes SPF return PermError, and the message is treated as if the domain had no working SPF record.
- Publish one TXT record on the root domain. A second SPF record also returns PermError.
- include, a, mx, ptr, exists, and redirect each count as a DNS lookup. Nested includes count too.
- ip4 and ip6 do not count toward the limit of 10.
- End with ~all while you are still testing, and -all once every legitimate sender is listed. +all lets anyone send as you.
Questions people ask
Why does SPF fail with PermError?
PermError means the record could not be evaluated. The usual causes are more than 10 DNS lookups, more than one SPF TXT record, or a syntax error. A PermError does not mean the sending IP was unauthorized. It means the check itself failed.
What is the difference between ~all and -all?
~all is a soft fail. Receivers may still deliver the message and treat it as suspicious. -all is a hard fail. Receivers should reject mail from IPs that are not listed. Use ~all only until you have confirmed every sender, then change it to -all.
Does an include count as one lookup?
Yes. include:example.com is one lookup, and every lookup inside that included record counts against the same limit of 10. A chain of Google, Microsoft, and a marketing tool often crosses the limit.
How do I check an SPF record?
Enter the domain above. The checker reads the live TXT record, walks the include chain, and counts lookups. It does not send a message and it does not change DNS.
The records are only half of inbox placement.
Once SPF, DKIM, and DMARC pass, a cold domain still needs a slow sending history. iSend warms the domain and sends with the same authentication these tools just checked.