SPF Checker
Enter any domain to check its SPF record. We validate the syntax, count DNS lookups, list authorized senders, and flag anything that could hurt your email deliverability.
Understanding Your SPF Check Results
Here's what each result means and what to do next.
SPF Pass
Your record is valid and well-configured
A passing result means your SPF record exists, has valid syntax, and stays within the DNS lookup limit. Receiving mail servers can verify that messages from your domain come from authorized sources. To complete your email authentication, make sure DKIM and DMARC are also configured.
- All syntax is correct
- DNS lookups are within the 10-lookup limit
- Authorized senders are listed
- No duplicate or conflicting mechanisms
SPF Warning
Your record works but has issues worth fixing
A warning means your SPF record is technically valid but has issues that could cause problems down the road. Common warnings include being close to the 10-lookup limit, using deprecated mechanisms like ptr, or having an overly permissive policy like +all that weakens your protection.
- Approaching the 10-lookup limit
- Deprecated mechanisms detected (e.g. ptr)
- Overly permissive policy (+all)
- Redundant or unnecessary includes
SPF Fail
Your record has issues that need to be fixed
A failing result means emails from your domain are at risk of being rejected or sent to spam. The most common causes are a missing record, syntax errors, exceeding the 10-lookup limit, or having multiple SPF TXT records on the same domain. Each of these is fixable — review the details above for specific guidance.
- No SPF record found
- Syntax errors in mechanisms or qualifiers
- Exceeded the 10 DNS lookup limit
- Multiple SPF records on the same domain
Common SPF Problems and How to Fix Them
These are the SPF problems we see most often. If your check flagged any of these, here's what they mean and how to fix them.
Too Many DNS Lookups
The #1 SPF problem we see
SPF allows a maximum of 10 DNS lookups per evaluation. Every include, a, mx, redirect, and exists mechanism triggers a lookup — and nested includes count too. Once you exceed 10, some receivers return a permerror and reject the message entirely.
Multiple SPF Records
A silent deliverability killer
The SPF spec requires exactly one SPF TXT record per domain. If your DNS has two, receivers should return a permerror — which means your SPF check fails regardless of what the records say. This often happens when a new service adds its own record without merging it into the existing one.
Softfail vs. Fail
Choosing the right policy
Your SPF record ends with a policy mechanism that tells receivers what to do with unauthorized senders. ~all (softfail) is the most common — it flags failures but doesn't reject. -all (hardfail) is stricter. +all allows everything and should never be used. The right choice depends on your DMARC policy and sending setup.
Missing Sending Sources
Authorized senders that aren't in your record
Every service that sends email on your behalf — your email platform, CRM, marketing tool, helpdesk — needs to be authorized in your SPF record. Missing even one means those messages fail SPF checks, which can hurt deliverability or trigger DMARC failures.
Why SPF Matters for Your Business
Emails Land in Spam
Your Domain Gets Spoofed
Deliverability Drops Silently
Compliance and Insurance Gaps
Check Your Full Email Authentication with iO™ DMARC
SPF is one piece of the puzzle. Use these tools to check the rest of your email authentication stack.
DKIM Checker
Verify your DKIM signature to make sure outgoing emails are cryptographically signed. DKIM works alongside SPF to prove your messages haven't been tampered with in transit.
DMARC Checker
Check your DMARC policy and alignment. DMARC builds on your SPF record and tells receivers what to do when authentication fails, it's the layer that actually enforces your policy.
BIMI Checker
See if your domain qualifies to display your brand logo in supported inboxes. BIMI requires a passing DMARC policy, which starts with a valid SPF record.
MTA-STS Checker
Check whether your domain enforces encrypted email delivery. MTA-STS prevents messages from being silently downgraded to unencrypted connections in transit.
TLS-RPT Checker
Verify your TLS reporting setup. TLS-RPT alerts you when sending servers fail to establish secure connections with your domain, so you catch delivery issues early.
Email Authentication Audit
Get a complete picture of your SPF, DKIM, DMARC, BIMI, and MTA-STS configuration in one report. See what's working, what's broken, and what to fix first.
Ready to secure your email domain?
SPF is just the first layer. iO™ DMARC manages your entire email authentication stack, so you don't have to.
Learn About SPF
SPF Record Examples
SPF Failure Troubleshooting
Managed Email Authentication
Ready to Fix Your Email Authentication?
Found issues with your SPF record? Or just want someone to handle email authentication so you don't have to think about it? Let's talk.
Tired of Fixing SPF by Hand?
iO™ DMARC handles your SPF record for you. One-click generation, automatic lookup counting, include flattening, and alerts the moment a third-party sender changes their setup on you.
Explore iO™ DMARC