SPF record checker

Check a domain's SPF record: whether it is valid, how many DNS lookups it uses out of the 10 allowed, and what to change to fix any problems.

For example example.com. You can paste a web address or email address.

Enter a domain to check its SPF record.

Lookups run in your browser using Cloudflare public DNS; the domains you check are not sent to ZeroDMARC.

What is SPF?

SPF (Sender Policy Framework, RFC 7208) lets a domain list the servers that may send email for it. The list is a single TXT record at the domain, starting with v=spf1, for example v=spf1 include:spf.protection.outlook.com -all for a domain that sends through Microsoft 365.

When a message arrives, the receiving server checks whether the server that delivered it is on the list for the domain in the envelope sender (the Return-Path address). That is often not the From address people see, so SPF alone does not stop someone spoofing your From address. DMARC closes that gap by requiring SPF or DKIM to pass for a domain that matches the From address.

An SPF record can include other domains' records, and each include, a, mx, ptr and exists mechanism costs a DNS lookup. A check may use at most 10. This checker follows every include and shows where the lookups go.

Next, check the domain's DMARC record.

Questions

What does "too many DNS lookups" mean?

Each include, a, mx, ptr and exists mechanism, and the redirect modifier, makes the receiving server look up another DNS record. RFC 7208 allows at most 10 of these per check. Over 10, receivers return a permanent error, and SPF fails for all of your mail, including legitimate mail. Remove includes for services you no longer use, or replace a and mx with ip4 and ip6 ranges.

Can a domain have more than one SPF record?

No. A domain must publish exactly one TXT record starting with v=spf1. With two or more, receivers return a permanent error and SPF fails. If you add a new email service, add its include to your existing record rather than publishing a second one.

Should my record end in ~all or -all?

Both tell receivers that servers you have not listed are not allowed to send for your domain. ~all (soft fail) marks such mail as suspicious; -all (fail) asks for it to be rejected. While you are rolling out DMARC, ~all is a safe choice. Once your DMARC reports show every legitimate sender passes, you can move to -all. Never use +all, which lets anyone send as your domain.

What is a void lookup?

A void lookup is a DNS lookup made by your SPF record that finds no records, for example an include of a domain that no longer exists. RFC 7208 allows at most 2. They usually come from services you stopped using; remove those terms from the record.

Does ZeroDMARC see the domains I check?

No. The check runs in your browser and asks Cloudflare public DNS (cloudflare-dns.com) directly. ZeroDMARC does not receive or store the domains you check.