Free · live registry data · no login

SPF Record Checker

Validate syntax, lookups count and the all-mechanism.

How it works

SPF checker: validate syntax, count lookups, grade the all mechanism

We fetch the live TXT records for your domain, find the v=spf1 record and parse every mechanism and qualifier. Then we follow each include and redirect recursively to count DNS lookups against the hard limit of 10, the single most common cause of SPF PermError. You get a 0–100 score, a plain-English flag for each problem and the exact record text so you can compare it with what you intended to publish.

Results appear here after you click Check SPF.

How this works

1
Fetch TXT records
The domain root is queried live over DNS-over-HTTPS and the v=spf1 record is isolated.
2
Parse every mechanism
Each term is split into qualifier, mechanism and value, with syntax errors flagged.
3
Count lookups recursively
Includes and redirects are followed so the total reflects what receivers actually evaluate.

Frequently asked questions

What does SPF PermError mean?: PermError means the record cannot be evaluated: usually more than 10 DNS lookups, two SPF records, or a syntax mistake. Receivers treat PermError as a failure, so fixing it is urgent.
Why does my SPF record have too many lookups?: Each include pulls in that provider's own includes. Google alone uses several, and adding Microsoft, a CRM and a helpdesk quickly exceeds 10. Remove services you no longer use or flatten includes into ip4 ranges.
Should I use ~all or -all?: Use ~all (softfail) while you confirm every legitimate sender is listed, then move to -all. With DMARC in place the difference matters less, because DMARC decides what happens to failures.
Does SPF cover email forwarded from my domain?: No. Forwarding breaks SPF because the forwarding server is not in your record. DKIM survives forwarding, which is why you need both for DMARC to pass.
How often should I check my SPF record?: Re-check whenever you add or remove an email service, and at least quarterly. Providers change their includes, which can silently push you over the lookup limit.

Every MailShrine domain includes WHOIS privacy, transfer lock, Anycast DNS with DNSSEC and two business mailboxes.