SPF record checker

Purpose

Check a domain’s SPF record: which servers may send email in its name, what happens to all the others (“-all”, “~all”, “+all”), how many DNS lookups it needs against the limit of 10 and every include.

Requirements

Anyone can read these guides, no account needed. Some tools require Pro, as indicated in each guide.

SPF is the DNS record where a domain lists the servers allowed to send its email. Without it, or with one that’s broken or too open, it’s easier to send fake emails in that domain’s name. Type a domain, an email address or a link and we’ll read its SPF and explain it.

How to use it

1. 1

   Type the domain you want to check, or paste an email address or a link: we only use its domain.

2. 2

   Press “Check SPF”. We read the SPF record and follow each include, as a receiving server would.

3. 3

   Look at how the record ends and at the lookup count: what you want to see is “-all” or “~all” and 10 lookups or fewer.

Synthetic example

v=spf1 include:_spf.example.com ~all

Interpret the result

This domain has no SPF: It doesn’t say which servers may send its email, which makes it easier to impersonate. If it’s your domain, publish an SPF record.

The SPF record has errors: Receiving servers can’t apply it, so for them the domain has no SPF. The signals below say what’s wrong.

Anyone can send email as this domain: The record ends in “+all”, which authorises every server in the world. Set up like this, SPF protects nothing.

The SPF doesn’t fully protect the domain: The record doesn’t say what to do with servers that aren’t on its list, so fake email in the domain’s name isn’t flagged.

SPF is set up correctly: The domain lists the servers that may send its email and asks receivers to flag or reject the rest. SPF alone doesn’t stop impersonation: DMARC is what tells receivers what to do.

+all: any server may send (dangerous)

?all: the record says nothing about them

~all: marked as suspicious

-all: rejected

No “all”: the record says nothing about them

Limitations

Troubleshooting

That doesn’t look like a public domain. Try something like example.com.

DNS didn’t answer in time. Try again in a few seconds.

You’ve run a lot of checks in a row. Wait a minute and try again.

Use with the API

Reads a domain’s SPF record as receivers do (RFC 7208): its terms, what it ends with, the DNS lookups across the whole include tree against the limit of 10, every include and whether it publishes SPF, and the record’s problems as signals. Nothing is stored.

Send the JSON body to the tool's own route, or to POST /v2/tools with the tool field added. Both routes return the same result.

POST https://api.nocall.io/v2/spf-check
POST https://api.nocall.io/v2/tools  {"tool":"spf-check","domain":"example.com"}

REQUEST_ID="$(uuidgen)" && [ -n "$REQUEST_ID" ] &&
curl --request POST 'https://api.nocall.io/v2/spf-check' \
  --header "Authorization: Bearer $NOCALL_API_KEY" \
  --header 'Content-Type: application/json' \
  --header "Idempotency-Key: $REQUEST_ID" \
  --data '{"domain":"example.com"}'

import json
import os
import urllib.request
import uuid

api_key = os.environ.get('NOCALL_API_KEY')
if not api_key:
    raise SystemExit('Set NOCALL_API_KEY')

request = urllib.request.Request(
    'https://api.nocall.io/v2/spf-check',
    method='POST',
    data=json.dumps({'domain': 'example.com'}).encode(),
    headers={
        'Authorization': 'Bearer ' + api_key,
        'Content-Type': 'application/json',
        'Idempotency-Key': str(uuid.uuid4()),
    },
)
with urllib.request.urlopen(request, timeout=30) as response:
    result = json.load(response)
print(result['data']['result'], result['meta']['unitsCharged'])

import { randomUUID } from 'node:crypto';

const requestId = randomUUID();
const apiKey = process.env.NOCALL_API_KEY;
if (!apiKey) throw new Error('Set NOCALL_API_KEY');

const response = await fetch('https://api.nocall.io/v2/spf-check', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer ' + apiKey,
    'Content-Type': 'application/json',
    'Idempotency-Key': requestId,
  },
  body: JSON.stringify({ domain: 'example.com' }),
});
const result = await response.json();
if (!response.ok) throw new Error(result.error?.code ?? 'request_failed');
console.log(result.data.result, result.meta.unitsCharged);

{
  "data": {
    "tool": "spf-check",
    "result": {
      "domain": "example.com",
      "domainAscii": "example.com",
      "found": true,
      "record": "v=spf1 include:_spf.google.com ~all",
      "recordCount": 1,
      "terms": [
        {
          "qualifier": "pass",
          "mechanism": "include",
          "value": "_spf.google.com"
        },
        {
          "qualifier": "softfail",
          "mechanism": "all",
          "value": null
        }
      ],
      "allResult": "softfail",
      "lookups": 1,
      "includes": [
        {
          "domain": "_spf.google.com",
          "found": true
        }
      ],
      "signals": [
        "softfail_all"
      ],
      "valid": true,
      "attention": false
    }
  },
  "meta": {
    "requestId": "req_example",
    "unitsCharged": 1,
    "usage": {
      "periodStart": "2026-10-01",
      "unitLimit": 20,
      "unitsUsed": 3,
      "unitsRemaining": 17
    }
  }
}

• API reference ↗

Frequently asked questions

Related guides

• DMARC checker
• DKIM checker
• MX record lookup