Free SPF checker. Is your sender list right?
Your SPF record tells inboxes which services may send email as you. Check yours in seconds, with plain-English results.
What an SPF record does
SPF (Sender Policy Framework) is one line of text in your DNS that lists the services allowed to send email using your domain. When a message arrives claiming to be from you, the receiving inbox checks whether the sending server is on that list.
Without it, your real email is more likely to land in spam, and inboxes have less to go on when someone fakes your address. On its own SPF does not stop fakes; a DMARC rule is what tells inboxes to act on a failure.
The mistakes we see most
Two SPF records. Someone adds a new service by creating a second record instead of editing the first. Both then fail.
A forgotten sender. The website contact form, invoicing system or newsletter tool sends as your domain but was never added, so those messages fail SPF and go to spam.
Too many lookups. Each service you add can cost several of the 10 lookups SPF allows. Past 10, SPF breaks for everything.
Leftovers. Old providers stay listed long after you moved, which widens who can send as you.
Checking more than SPF
The check above also looks at your mail servers and DMARC rule, because an SPF record only helps when the rest is right. For every record type, use the full email and DNS checker. If your mail is landing in spam, read business email going to spam.
Common questions
Can a domain have two SPF records?
No. There must be exactly one SPF record at your domain. With two, inboxes treat SPF as broken for every message, so even your real email loses its trust signal. Combine every sender into one record instead.
What should my SPF record say for Microsoft 365?
For Microsoft 365 alone it is usually v=spf1 include:spf.protection.outlook.com -all. If other services send as you, each one needs adding to that same record.
What should my SPF record say for Google Workspace?
For Google Workspace alone it is usually v=spf1 include:_spf.google.com ~all. Other services that send as you go into the same record.
What is the difference between ~all and -all?
Both tell inboxes that mail from servers not on your list is suspect. -all says reject it, ~all says treat it as suspicious. Either is fine once DMARC is in place. +all approves every server in the world and should never be used.
Does this checker count SPF lookups?
No. SPF allows at most 10 DNS lookups when an inbox checks it, and each include can use several. Going over breaks SPF. Counting them means following every include, which we do as part of a DNS and email fix.
Related help
Free email and DNS checker
Check your mail servers, SPF and DMARC in seconds, explained in plain English.
Free DKIM checker
See whether your email carries a digital seal that proves it really came from you.
Free DMARC checker
See whether fake emails using your domain are watched, sent to spam or blocked.
Free email header analyzer
Paste an email’s headers to see its route, delays and sender checks, in your browser.
Business email going to spam
Authentication, reputation, and the fixes that actually move the needle.
Get a quote
Tell us what you need and we will map out the simplest path.
Need a DNS or email problem fixed?
We can investigate your setup and quote a one-time repair, done remotely. If you need continued help, ask about remote IT support.