SPF checker: is your domain’s SPF record right?
Enter your domain: we read the SPF record and tell you right away whether it exists, whether it’s unique, how it ends and how many DNS lookups it uses.
- Free, no sign-up
- Public DNS records only
- Result in seconds
Want the step-by-step fixes?We email you the full report on SPF, DKIM, DMARC and MX, with the values to copy.
Done: the report reaches your inbox in a few minutes. If you don’t see it, check spam or Promotions too.
What an SPF record is
SPF is a TXT record on your domain that lists the servers allowed to send email on your behalf. Receiving servers read it and compare it with the server that delivered the email.
It always starts with v=spf1, contains the include: of the services you send from (mailbox, website, newsletter tool) and ends with ~all or -all. Example: v=spf1 include:_spf.google.com ~all.
v=spf1The start: it says this is an SPF record.include:_spf.google.comAuthorizes Google Workspace servers.include:app.mailsenpai.comAuthorizes SMTP Senpai, if you send with us.ip4:203.0.113.10Authorizes one server with a specific IP address.~allAny other server: treat the email as suspicious.The problems we find most often
Two SPF records
With more than one record starting with v=spf1 the check fails: merge them into one.
More than 10 DNS lookups
Every include uses lookups; above 10 the check errors out. Remove services you no longer use.
An include that no longer exists
A retired service leaves an empty include that makes the check fail.
Ending with +all or ?all
+all authorizes anyone, ?all says nothing: use ~all or -all.
Frequently asked questions
~all or -all?
~all flags email from unlisted servers as suspicious, -all asks receivers to reject it. Most people start with ~all and move to -all once every sending service is listed.
Can I have two SPF records?
No. A domain must have a single SPF record: with two, the check fails. Merge the includes into one record.
What counts towards the 10-lookup limit?
Every include, a, mx, ptr, exists and redirect, including those inside includes. ip4 and ip6 don’t count.
How soon will I see my changes?
Usually from a few minutes to a few hours, depending on the record’s TTL. Check again after a while.
More free checks
DKIM checker
Key on the most common selectors or yours, length and revocation.
OpenDMARC checker
Policy, reports address, inherited record.
OpenMX lookup
Who receives the mail, priorities and spam filters.
Open554 5.7.1 error
Why the email was rejected and how to fix it.
OpenFull DNS check
SPF, DKIM, DMARC and MX at once, with the report by email.
OpenFree DNS check API
JSON, no key, CORS enabled.
OpenDo your website or app emails still leave from the hosting server?
SMTP Senpai is the MailSenpai SMTP relay: it signs your emails with DKIM on your own domain, gives you the DNS records to publish and checks them for you. Servers and data in the EU.