Free SPF Record Checker
Look up any domain's SPF record in your browser: the policy at its end, the DNS lookup count against the limit of 10, and the senders it authorizes. DMARC and DKIM come with it.
Three things an SPF record gets right or wrong
A record that exists is not a record that works. The policy, the lookup count and the list of senders each decide whether spoofed mail is stopped and whether your own mail arrives.
Policy
The all mechanismThe end of the record decides what happens to a sender that is not listed. -all rejects it, ~all marks it, +all lets anyone send as you.
Lookups
The limit of 10Every include, a, mx, ptr, exists and redirect costs a DNS lookup, and receivers stop at 10. Past that the record fails and legitimate mail bounces.
Senders
Who may send as youEach include names a service that sends for you: your mail provider, your CRM, your ticketing tool. A sender missing here fails SPF; a stale one is a spoofing door.
Know the moment an SPF record changes.
FortWatch checks the SPF, DKIM and DMARC records of every domain you own, hour by hour, and alerts you when a policy weakens, a lookup limit is crossed or a sender appears that nobody added.
- SPF, DKIM and DMARC watched on every domain, not just one
- An alert when -all turns into ~all or a record disappears
- The fix written out for each finding, ready to paste into DNS
Common questions about SPF records
What is an SPF record?
▾
SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers allowed to send email as you. A receiving mail server reads it, checks the sending server against the list, and treats mail from anywhere else as suspect. It is the first of the three email authentication records; DKIM and DMARC build on it.
What do -all, ~all and +all mean at the end of an SPF record?
▾
The last mechanism says what happens to a sender that matched nothing before it. -all is a hard fail: reject. ~all is a soft fail: accept but mark. ?all is neutral and +all allows anyone, which makes the record pointless. Finish with -all once every real sender is listed, and with ~all while you are still finding them.
Why does the checker count DNS lookups?
▾
The SPF standard, RFC 7208, lets a receiver make at most 10 DNS lookups while evaluating your record. Every include, a, mx, ptr, exists and redirect costs one, and the includes of your includes count too. Past 10 the record fails as a permanent error and your mail can be rejected. The checker counts the top-level mechanisms so you see how close you are.
How do I add or fix an SPF record?
▾
Publish one TXT record on the root of your domain, starting with v=spf1, listing each sending service with the include your provider documents (for example include:_spf.google.com), and ending with -all or ~all. One record only: two SPF records on the same domain fail. Check it here again after the DNS change propagates.
Is SPF enough on its own?
▾
No. SPF checks the sending server, not the message, and it breaks on forwarded mail. DKIM signs each message so its content and From domain can be verified, and DMARC tells receivers what to do when either check fails and sends you reports. The result below shows all three, so you see the whole picture at once.
How does this SPF checker work, and is it free?
▾
It reads the TXT records of the domain you enter through Cloudflare's public DNS over HTTPS, straight from your browser, and evaluates the SPF record it finds. Nothing is sent to our servers and nothing is logged. It is free, with no signup and no limit on checks.
Try another tool
DMARC & SPF Checker
Check any domain's SPF, DMARC, and DKIM records. Catch what spoofers can exploit.
DKIM Checker
The DKIM key of any domain at its selector or the common ones, with the public key checked.
DNS Lookup
A, AAAA, MX, NS, TXT, CNAME records for any domain — direct from Cloudflare 1.1.1.1.
Subdomain Finder
Find every subdomain a domain has ever issued a certificate for via Certificate Transparency logs.
Security Headers Checker
Grade any site's HTTP security headers — missing, weak, and what your server leaks.
CAA Record Checker
Which certificate authorities a domain allows to issue its certificates, and what to publish when none is set.
DNSSEC Checker
Whether a domain is signed and validated: DS at the parent, the DNSKEY set, the chain resolvers accept.
Subdomain Takeover Checker
Subdomains whose CNAME points at a service that no longer answers, the records an attacker can claim.
security.txt Checker
A site's security.txt checked against RFC 9116: contact, expiry, canonical address, signature.