SPF record checker: who can send email as this domain?

SPF is the DNS record where a domain lists the servers allowed to send its email. Without it, or with one that’s broken or too open, it’s easier to send fake emails in that domain’s name. Type a domain, an email address or a link and we’ll read its SPF and explain it.

Add as a preferred source Download onGoogle Play Download onApp Store

How to use it

Type the domain you want to check, or paste an email address or a link: we only use its domain.
Press “Check SPF”. We read the SPF record and follow each include, as a receiving server would.
Look at how the record ends and at the lookup count: what you want to see is “-all” or “~all” and 10 lookups or fewer.

What each result means

This domain has no SPF: It doesn’t say which servers may send its email, which makes it easier to impersonate. If it’s your domain, publish an SPF record.
The SPF record has errors: Receiving servers can’t apply it, so for them the domain has no SPF. The signals below say what’s wrong.
Anyone can send email as this domain: The record ends in “+all”, which authorises every server in the world. Set up like this, SPF protects nothing.
The SPF doesn’t fully protect the domain: The record doesn’t say what to do with servers that aren’t on its list, so fake email in the domain’s name isn’t flagged.
SPF is set up correctly: The domain lists the servers that may send its email and asks receivers to flag or reject the rest. SPF alone doesn’t stop impersonation: DMARC is what tells receivers what to do.

What each signal means

The domain publishes no SPF record.
A domain (this one or an included one) publishes more than one SPF record. Only one is allowed, so receivers treat it as an error.
The record has a term that’s written wrongly, so receivers treat it as an error.
The record needs more than 10 DNS lookups counting all its includes. Above 10, receivers treat it as an error.
An include points to a domain that has no SPF record, so receivers treat the record as an error.
The includes go round in a loop: a domain ends up including itself.
It ends in “+all”: any server in the world may send email as this domain.
It ends in “?all”: it says nothing about servers that aren’t listed, so it doesn’t protect.
It ends in “~all”: email from other servers is marked as suspicious but not rejected. It’s the most common setting.
It has no “all” at the end, so servers that aren’t listed get a neutral result and no protection.
It uses “ptr”, a slow mechanism the standard advises against. Many receivers skip it.
It uses macros (terms with %) that change with each message, so we can’t follow that part and the real lookup count may be higher.

Which countries it covers

Works with domains from any country. We read the record as receiving servers do (RFC 7208): its mechanisms, how it ends, every include and redirect up to 30 lookups, and its count of DNS lookups against the limit of 10.

We read the domain’s public DNS records. If you type an email address or a link, only its domain leaves your browser. The domain you look up isn’t stored.

Frequently asked questions

What is SPF?

Sender Policy Framework: a DNS record where a domain lists the servers allowed to send its email. The server that receives a message checks whether the server that delivered it is on that list.

Which is better, “-all” or “~all”?

“-all” asks receivers to reject email from servers that aren’t listed; “~all” asks them to mark it as suspicious. Both protect, and many domains use “~all” and let DMARC decide what to do. “+all” and “?all” don’t protect.

Why does the limit of 10 lookups matter?

Each include, a, mx, ptr, exists and redirect makes the receiving server query DNS. If the whole record needs more than 10, it’s treated as an error and SPF stops working. Remove services you no longer use or ask your provider for a simpler include.

Does SPF stop fake emails on its own?

No. SPF checks the hidden envelope sender, not the address you see in “From”. DMARC is what ties the two together and asks receivers to quarantine or reject email that fails. Check the domain’s DMARC too.