Free SPF checker

Why SPF matters for a small business

If your quotes, invoices or enquiry replies land in spam, email authentication is the first place to look. SPF (Sender Policy Framework) is the record on your domain that lists which services may send email as you: your email provider, plus anything else that sends on your behalf, like a booking system, invoicing tool or newsletter platform. Receiving servers check it, and a missing or broken record makes your genuine mail look forged.

This checker reads your SPF record from public DNS, follows every include the way a receiving server does, and grades the result from A to F. It doesn't send any email, and nothing on your mail server changes.

What this checker tests

One record, not two. Having two v=spf1 records is a common mistake after switching provider, and it makes SPF fail for every message.

Every term is one SPF understands. A typo such as inculde: is a permanent error: receivers give up on the whole record. We also flag terms that sit after the all rule, because receivers stop reading at all and never see them, and the ptr mechanism, which the standard discourages.

The all rule. The record should end with ~all or -all. +all lets anyone send as you, and ?all offers no protection.

The 10-lookup limit. Every include:, a, mx, ptr, exists and redirect costs a DNS lookup, including the ones inside the records you include. We follow the whole chain, count them, and show where each lookup comes from. If you're over the limit, we tell you by how much.

Broken includes. An include pointing at a service you no longer use, or a mistyped domain, is a permanent error.

Your mail provider is listed. If your mail servers are Google Workspace or Microsoft 365 and the record doesn't include them, mail you send through them can fail SPF.

How the grade works

The grade runs from A to F, and the report puts the top fix first. One valid record, a protective all rule and staying well inside the lookup limit carry most of the weight. Eight to ten lookups still works, but costs a few points, because one new sending service could tip you over.

Some problems cap the grade however well the rest scores:

• No SPF record, or more than one, is an F.
• A permanent error (over 10 lookups, a broken include or a term SPF doesn't recognise) caps you at E, because SPF then fails for every message.
• ?all, or no all rule at all, caps you at D.
• +all, which lets anyone send as you, is an F.

A domain with no mail servers is graded differently. If it never sends email, the only right record is v=spf1 -all, which tells receivers to refuse anything claiming to come from it. A parked domain set up that way scores an A.

Your corrected SPF record

When we can build a better record without guessing, the result includes one to paste in as a TXT record on your domain:

• Two or more records: we merge them into one, keeping every sender from each.
• ?all, +all or no all rule: we keep every sender you list and end the record with ~all.
• A domain that sends no email: you get v=spf1 -all.

We never add a service you haven't listed ourselves, because a guessed list could block your genuine mail. If you have no SPF record at all, the result tells you what to include for your mail provider instead.

Getting under 10 lookups

There is no ready-made record for this one, because the right answer depends on what you still use. In order:

1. Remove any service you no longer send through. Old marketing tools and previous email providers are the usual culprits.
2. Move bulk senders, such as a newsletter or marketing platform, to a subdomain like news.yourdomain. Each subdomain has its own SPF record and its own 10 lookups.
3. Replace an include: with the ip4: and ip6: ranges it publishes. This is called flattening. It works, but providers change their ranges without warning, so only do it with a tool that keeps them up to date.

SPF isn't enough on its own

SPF checks the hidden envelope sender, not the From address people see, and it doesn't tell receivers what to do when a check fails. That's DMARC's job. Once your SPF is right, use the DMARC and email security checker to grade your SPF, DKIM and DMARC together. The free website audit also checks SPF and DMARC alongside everything else that affects whether your site and email are trusted.