Free tool
SPF record checker
An SPF record checker looks up the TXT record that starts with v=spf1 on your domain and tests it. It confirms there is exactly one SPF record, that the syntax is valid, that it stays within the limit of 10 DNS lookups, and that it ends in a clear policy such as ~all or -all. You can check any domain free with the SPF checker on this page.
- ISO 27001 compliant
- SOC 2 Type 2 compliant
- Preferred Cloudflare Partner
- 24/7 follow-the-sun support
What does an SPF record checker test?
- That the domain publishes one SPF record. Two v=spf1 records make SPF fail outright.
- That every mechanism (include, a, mx, ip4, ip6, redirect) is valid syntax.
- The number of DNS lookups. More than 10 causes a permerror and receivers treat the record as broken.
- The final qualifier: -all rejects unlisted senders, ~all marks them, and +all lets anyone send as you.
- Whether each include still resolves. Old includes for tools you stopped using waste lookups.
How to fix the most common SPF errors
Too many lookups: remove includes for services that no longer send for you, and replace stable senders with their ip4 or ip6 ranges where the provider publishes them.
Multiple records: merge them into a single v=spf1 record. DNS hosts often add a second one when you connect a new mail tool.
Ending in +all or ?all: change it to ~all while you confirm every sender is listed, then move to -all.
example.com. TXT "v=spf1 include:_spf.google.com include:sendgrid.net ~all"SPF qualifiers at a glance
| Ending | Meaning | When to use it |
|---|---|---|
| -all | Hard fail: reject mail from unlisted servers | Once DMARC reports show every real sender passes |
| ~all | Soft fail: accept but mark as suspicious | While you are still finding all your senders |
| ?all | Neutral: no opinion | Rarely useful; gives receivers nothing to act on |
| +all | Pass everything | Never. Anyone can send as your domain |
SPF is one of three checks
SPF says which servers may send for your domain. DKIM signs each message, and DMARC tells receivers what to do when SPF or DKIM fails. Mailbox providers such as Google and Yahoo expect all three from bulk senders, so check DKIM and DMARC after SPF.
How Vigilbase helps
Vigilbase runs security operations and website protection for businesses that would rather not build a security team.
Email security
Phishing protection and DMARC enforcement, set up and kept current for you.
Learn moreVigilbase OS
AI investigates every alert and brings you only verified threats, with the fix ready to approve.
Learn moreVigilbase Shield
Managed Cloudflare WAF, DDoS and bot protection, configured and watched by our team.
Learn moreFrequently asked questions
What is the SPF 10 DNS lookup limit?
RFC 7208 limits SPF evaluation to 10 mechanisms that need a DNS lookup (include, a, mx, ptr, exists and redirect). Past 10, receivers return a permerror and SPF fails, even if your sending server is listed.
Should my SPF record end in -all or ~all?
Use ~all (soft fail) while you confirm every service that sends for you is listed. Once DMARC reports show nothing legitimate failing, -all (hard fail) gives the strongest signal. Never use +all.
Can a domain have two SPF records?
No. A domain must publish exactly one v=spf1 TXT record. Two records cause a permerror, so merge them into one.
Is this SPF checker free?
Yes. The check runs on vigilbase.com at no cost and needs no account.
More free tools and guides
Security handled, around the clock
Vigilbase is ISO 27001 and SOC 2 Type 2 compliant and a Preferred Cloudflare Partner, with follow-the-sun support from teams in Kenya, South Africa, the UAE and Portugal.