Free SPF checker
Check your domain's SPF record for the mistakes that send your emails to spam: a missing or duplicate record, a weak all rule, and more than 10 DNS lookups. Plus your DMARC policy. No signup.
We look up your public DNS records. Nothing is sent or stored.
Why SPF matters for a small business
If your quotes, invoices or enquiry replies land in spam, email authentication is the first place to look. SPF (Sender Policy Framework) is the record on your domain that lists which services may send email as you: your email provider, plus anything else that sends on your behalf, like a booking system, invoicing tool or newsletter platform. Receiving servers check it, and a missing or broken record makes your genuine mail look forged.
What this checker tests
One record, not two. Having two v=spf1 records is a common mistake after switching provider, and it makes SPF fail for every message. The all rule. The record should end with ~all or -all; +all lets anyone send as you, and ?all offers no protection. The 10-lookup limit. Every include:, a, mx, ptr, exists and redirect costs a DNS lookup, including the ones inside the records you include. We follow the whole chain and count them, because going over 10 breaks SPF silently. Broken includes. An include pointing at a service you no longer use, or a mistyped domain, is a permanent error.
SPF isn't enough on its own
SPF checks the hidden envelope sender, not the From address people see, and it doesn't tell receivers what to do when a check fails. That's DMARC's job, so this tool checks your DMARC record too. For the full policy detail, use the DMARC checker. The free website audit also checks SPF and DMARC alongside everything else that affects whether your site and email are trusted.
This is one check. Your site needs dozens.
The full AuditCrow audit runs this alongside speed, SEO, accessibility, trust and AI readiness, then tells you what to fix first, in plain English.
Common questions
Straight answers about what this check does, and doesn't do.
What is an SPF record?
SPF (Sender Policy Framework) is a TXT record on your domain listing the servers allowed to send email as you. Receiving mail servers check it to spot forged mail. You should have exactly one, starting v=spf1 and ending ~all or -all.
What is the SPF 10 lookup limit?
Checking SPF can make at most 10 DNS lookups, counting every include:, a, mx, ptr, exists and redirect, including those inside the records you include. Go over and SPF fails for every message. This checker follows your includes and counts them for you.
Should I use ~all or -all?
~all (soft fail) marks mail from unlisted servers as suspicious; -all (hard fail) rejects it. ~all is the common, safer choice while you're still finding every service that sends for you. Once DMARC is enforcing, either works well.
Why does an SPF checker also show DMARC?
SPF on its own doesn't tell receivers what to do when a check fails, and it doesn't protect the From address people actually see. DMARC ties SPF (and DKIM) to that address and sets the policy, so you need both. DKIM isn't checked here because it needs your provider's selector name.
From the blog
All postsHTTPS and Security Headers: The Trust Signals Most Sites Get Wrong
The padlock icon is just the start. Here's what HTTPS and security headers actually protect - and why Google and visitors both care.
Read moreWhat Is a Website Security Audit? A Plain-English Guide
A website security audit checks your site for weaknesses an attacker could exploit. Here's what it covers, what you can check yourself, and when to call in a professional.
Read moreHow to Audit Your Website: The Technical SEO Checklist Every Small Business Should Run
What an SEO audit actually checks, how to run one yourself for free, and the ordered checklist of technical fundamentals that decide whether Google can find, crawl, and rank your site.
Read moreOther free tools
Quick checks for the things that most often go quietly wrong.