SPF Record Checker

What exactly does this checker look up?

It asks Cloudflare’s DNS-over-HTTPS service for the TXT records of the domain you enter and picks the first one that begins with v=spf1. It then lists the record, the policy from the final all mechanism, each include:, ip4: and ip6: entry, any redirect= target, and a mechanism count. A domain with no such record reports Not found.

Does it count DNS lookups for the 10-lookup limit?

Yes. SPF allows ten DNS-querying terms (include, a, mx, ptr, exists and the redirect modifier) per evaluation, counted across nested includes; ip4, ip6 and all do not count. The tool follows include and redirect targets, looking up each one, and shows the total as, for example, 3 of 10 allowed: green up to 8, amber at 9 or 10, red above 10. To stay quick it makes at most 20 extra lookups and says so if it stops early. It counts each include, a, mx, ptr, exists and redirect term once and does not count the extra address lookups that a receiver makes for each mx host, so a record shown at 9 or 10 may already be over the limit in practice.

What is the difference between -all, ~all, ?all and +all?

The qualifier on all sets the result for senders that matched nothing earlier: - is fail, ~ is softfail, ? is neutral and + is pass. A +all lets any server send as your domain, so the tool flags it as an error. -all is shown as good, while ~all and ?all are shown as warnings. Many organisations publish ~all while they confirm every sender is listed, then tighten to -all.

Why does it say there is no "all" mechanism?

The tool recognises all in any case and with or without a qualifier; a bare all is treated as +all, which allows anyone to send. If none is present and the record uses redirect=, the Policy line says the policy is delegated to the redirect target, and you should check that domain’s record for its all. A record with neither an all nor a redirect has no default result, so receivers treat unmatched senders as neutral.

Can I have two SPF records on one domain?

No. A domain must publish exactly one v=spf1 record, and receivers treat two as a permanent error. If the tool finds more than one at the domain you entered, or at any include or redirect target it follows, it shows a Multiple SPF records or Problem line. It analyses the first record it sees, so merge your senders into one record and re-check.

Does a passing SPF record mean my email is authenticated?

Not by itself. SPF checks the sending server against the envelope sender (the Return-Path domain), not the visible From address. A message can pass SPF and still fail DMARC if the two domains do not align. SPF also commonly fails when mail is forwarded. Check DKIM and DMARC as well.

Why can a record be correct but look different from what I published?

DNS providers split long TXT values into quoted strings of up to 255 characters. The tool joins those strings back together before displaying the record. Recent changes may also take time to appear because resolvers cache answers until the TTL expires.