A free SPF checker that resolves the live SPF record for any domain, counts the SPF DNS lookups, and validates every SPF mechanism. An SPF record checker and validator in one, no signup.
An SPF checker resolves the TXT record your DNS actually serves and evaluates the SPF the way a receiving mail server would. That matters because the SPF string in your DNS panel and the one receivers see are not always identical.
The free SPF record checker walks every nested include, counts the recursive DNS lookups against the ten-lookup ceiling, validates each mechanism, and reports the effective policy. It is an SPF record checker and validator rather than a plain lookup.
Run the SPF checker after every publish and after every provider change. SPF fails silently — nothing announces that an SPF record started returning permerror except the delivery numbers, weeks later, so an SPF checker in the routine beats an SPF checker in an emergency.
Authorizes a specific IPv4 address or CIDR range. Example: ip4:203.0.113.1 or ip4:203.0.113.0/24.
Authorizes a specific IPv6 address or range. Example: ip6:2001:db8::1.
Authorizes the mail servers listed in the domain's MX records. Useful when your outgoing and incoming mail servers are the same.
Imports and evaluates another domain's SPF record. Used to authorize third-party senders like Google Workspace or SendGrid.
Authorizes the IP addresses from the domain's A or AAAA records. Useful for web servers that also send mail.
A catch-all that applies to senders not matched by any other mechanism. Prefixed with ~(softfail), -(hardfail), or ?(neutral).
What gets resolved
An SPF checker does not read the SPF record you think you published. It resolves what your DNS actually serves, which is frequently a different string, and evaluates that SPF the way a receiving mail server would.
The SPF record checker queries your domain for TXT records and finds the one beginning v=spf1. That is the only string receivers ever see, and DNS panels routinely split, wrap, or truncate long values on the way in.
A record that looks perfect in the control panel and resolves broken is one of the most common SPF failures. Only a live SPF checker catches it.
Every include:, a, mx, ptr, and exists: mechanism costs one lookup, and RFC 7208 caps evaluation at ten. Cross the ceiling and receivers return permerror, which most treat as no SPF at all.
The free SPF record checker walks every nested include and reports the real total, because the count that matters is the recursive one, not the number of mechanisms you typed.
Unknown mechanisms, a missing v=spf1 prefix, two SPF records on one domain, a stray +all — an SPF record checker and validator surfaces each of these with the specific reason rather than a generic failure.
The final qualifier gets called out separately, because ~all and -all produce very different receiver behaviour and people frequently publish the one they did not intend.
After resolution the SPF checker reports what a receiver would conclude: which sources are authorised, what happens to everything else, and whether evaluation would terminate early.
That is the useful output. The raw string is easy to read; the resolved behaviour is what determines delivery.
Reading the result
Five findings cover almost everything an SPF checker reports, and each one has a specific fix.
The domain publishes no TXT record starting v=spf1. Receivers have nothing to evaluate, so nothing is authorised and nothing is denied.
Generate one before you do anything else. An SPF record checker cannot validate a record that does not exist.
More than one v=spf1 TXT record is a permerror. Receivers do not merge them; they give up. This usually happens when a provider adds a record without checking for an existing one.
Merge the mechanisms into a single record and delete the extra one. The SPF record checker and validator will confirm the merge resolves cleanly.
More than ten recursive lookups means permerror. Adding one more provider include is usually what tips it over.
Replace provider includes with explicit ip4 ranges where the provider publishes stable addresses; ip4 costs no lookups. Then re-run the free SPF record checker to confirm the count dropped.
+all authorises the entire internet to send as your domain. ?all enforces nothing. Both make the record decorative.
Change it to ~all while you audit senders, then -all. An SPF checker that stays quiet about this is not doing its job.
A typo in an include hostname, a malformed CIDR, an unknown mechanism name. Evaluation stops and returns permerror.
Fix the token the free SPF record checker names and re-query. Propagation delay means the SPF record checker may serve a cached answer for a few minutes.
When to run it
SPF breaks quietly. Nothing tells you it stopped working except the delivery numbers, weeks later.
DNS propagation plus panel mangling means the record you saved and the record served are not reliably the same. Run the SPF checker as soon as propagation finishes.
This single habit catches the majority of SPF problems before any mail is affected, and a free SPF record checker costs nothing to run twice.
Adding a marketing platform, moving transactional mail, retiring an old server. Each change alters the authorised set and the lookup count.
Re-run the free SPF record checker after every provider change, not once a year.
A sudden spam-folder shift often traces back to an SPF record that quietly started returning permerror.
Check SPF first; it is the cheapest of the three authentication records to rule in or out.
Moving from soft fail to hard fail is the moment an unlisted legitimate sender starts bouncing. Confirm the record is complete first.
Then verify the addresses you are sending to as well — for that, use Email Verifier, because a clean SPF record does nothing about a list full of dead mailboxes.
Limits
SPF is one record among three. A clean SPF result is necessary and nowhere near sufficient.
An SPF record checker resolves one record. Message signing and From-domain alignment are separate records with separate failure modes.
A domain can pass SPF perfectly and still be trivially spoofable in the visible From line.
Forwarding rewrites the delivering IP while keeping your envelope sender, so SPF fails on legitimate mail. No SPF checker can distinguish that from an attack.
This is what DKIM and DMARC alignment exist to solve.
A perfect record does not mean the addresses you send to exist. Sender authentication and recipient verification are different problems entirely.
Run both before a campaign, not one or the other.
Content, complaint rate, bounce rate, and sending reputation all outrank authentication once the basics pass.
Get the SPF record clean with the free SPF record checker, then work on everything else.
Reference
SPF is defined by the IETF, and the tools beside this SPF checker cover what an SPF checker does not.
The IETF's RFC 7208 defines SPF syntax, the mechanisms, the qualifiers, and the ten-lookup evaluation limit this SPF record checker enforces.
Every finding the SPF record checker and validator reports maps back to a rule in that document.
If the SPF record checker finds nothing, or finds a mess, the SPF Record Generator builds a clean record from your actual sending sources.
Generate there, verify here. The pairing catches DNS-panel mangling that neither tool sees alone.
SPF alone leaves the visible From unprotected. The DMARC Checker and the DKIM tools cover alignment and signing.
Run all three; a free SPF record checker result on its own is an incomplete picture.
Nineteen free tools alongside the paid AI features, none of them requiring an account.
Free Tools
Free SPF record generator: build a valid v=spf1 TXT record for any domain in seconds. SPF record generator, no signup, with the 10-lookup limit checked.
Domain or infrastructure evidence — not mailbox proof.
Free Tools
Free DKIM record checker: resolve the live DKIM record at any selector, validate the public key, and flag truncation or testing mode. A DKIM record checker and validator.
Free Tools
Free DMARC record checker: resolve the live DMARC record for any domain, parse every tag, and report the effective policy. DMARC record checker and validator, no signup.
Free Tools
Free DNS record lookup for any domain: A, AAAA, MX, TXT, NS, CNAME, SOA resolved live from authoritative nameservers. DNS record lookup tool, free, no signup.
Email Tools
Free email deliverability test: send one message and get authentication, DNS, spam-filter, blacklist, header, and content scores. A free email inbox placement test, no signup.
Sender or message diagnostics — not address discovery.
Email Verify Tools
Check if an email address is valid with a free email verifier, no signup — syntax, MX, SMTP mailbox, disposable, role and catch-all checks.
Recipient evidence — not sender or DNS configuration.
Yes — a free SPF checker with no signup and no account. Run the SPF checker on as many domains as you need. It resolves live SPF on each request rather than serving a cached SPF verdict.
The resolved SPF record, the recursive DNS lookup count against the ten-lookup limit, any syntax errors, whether more than one SPF record exists, the final qualifier, and the effective policy a receiver would apply. That is what makes this a free SPF record checker and validator rather than a raw TXT lookup.
RFC 7208 caps SPF evaluation at ten DNS lookups, counted recursively through every include. Cross it and receivers return permerror, which most treat as no SPF at all. Replace provider includes with explicit ip4 ranges where you can — ip4 costs no lookups — then re-run the free SPF record checker.
Yes. One SPF record per domain. Receivers do not merge two v=spf1 records; they return permerror. Merge the mechanisms into a single record, delete the other, and confirm with the SPF record checker and validator that the result resolves cleanly.
That is usually the DNS panel splitting or truncating a long TXT value on save. The SPF checker reports what your nameservers actually serve, which is the only string that matters. Re-publish the record, wait for propagation, and check again.
No. SPF authorises the envelope sender, which recipients never see. A clean SPF checker result still leaves the visible From address unprotected — only DMARC ties the two together, so pair the SPF checker with a DMARC check.
A free SPF record checker, no signup. Resolve the live SPF record, count the SPF lookups, validate every SPF mechanism.
SPF checker, no signup · Free SPF record checker, live DNS · Instant API access · No credit card required
