What is an SPF record checker?

It reads the domain’s TXT records, keeps the v=spf1 string, lists mechanisms (include, ip4, mx, all…), follows include/redirect, and counts DNS lookup terms toward RFC 7208’s limit of 10.

What is the 10 DNS lookup limit?

include, a, mx, ptr, exists, and redirect each count as one lookup during evaluation. More than 10 is a permerror — receivers must not treat the message as a pass. Nested includes count. The initial TXT fetch is not one of those ten terms.

Does this tool send my domain to your servers?

No. TXT and include queries go from your browser to Cloudflare 1.1.1.1 and/or Google DoH. We do not run a nameserver and we do not store the domain.

What does ~all vs -all mean?

−all is fail (not authorized). ~all is softfail (not authorized, many inboxes still accept). +all authorizes the world and is almost always a mistake. ?all is neutral.

Why do I have multiple SPF records?

Two v=spf1 TXT strings are a permerror. Merge them: one record, several include: or ip4: terms. Do not publish a second SPF “to add Google.” Flatten or include instead.

Runs in your browser · Last updated 11 September 2026

Free SPF Record Checker

Free SPF record checker. Read v=spf1 TXT records, follow includes, and count DNS lookups toward the RFC 7208 limit of 10. Browser DoH — nothing is uploaded.

DomainOptional sender IP

DoH provider

TXT and include lookups use DNS-over-HTTPS in this tab (Cloudflare 1.1.1.1 and/or Google). The domain is not uploaded to our servers.

How to use this tool

Enter the mail domain (the part after @), not an individual mailbox.
Optionally paste a sending IP to evaluate ip4/ip6/include against that host.
Read the record, the include tree, and the n / 10 lookup counter.

SPF in the browser, over DoH

Sender Policy Framework is one TXT string that starts v=spf1. Clone checkers often hide a server-side dig TXT. This page uses the same DNS-over-HTTPS path as the DNS lookup checker: Cloudflare 1.1.1.1 first, Google Public DNS if that transport fails. The hostname never hits our origin.

The useful part is the lookup counter. A domain that include:s Google, Microsoft, Salesforce, and a marketing ESP can quietly walk past ten terms. This tool follows those includes and stops with a permerror once the budget is gone — the same rule receivers apply.

Worked example

Sample loads example.com. That zone’s policy is v=spf1 -all: zero include/a/mx terms, so the meter reads 0 / 10, and every sender IP fails. Contrast a record like v=spf1 include:_spf.google.com ~all — that is one lookup for the include, plus whatever Google’s record adds. Paste a sending IP only when you want pass / fail / softfail against ip4, ip6, and the include tree.

Frequently asked questions

What is an SPF record checker?: It reads the domain’s TXT records, keeps the v=spf1 string, lists mechanisms (include, ip4, mx, all…), follows include/redirect, and counts DNS lookup terms toward RFC 7208’s limit of 10.
What is the 10 DNS lookup limit?: include, a, mx, ptr, exists, and redirect each count as one lookup during evaluation. More than 10 is a permerror — receivers must not treat the message as a pass. Nested includes count. The initial TXT fetch is not one of those ten terms.
Does this tool send my domain to your servers?: No. TXT and include queries go from your browser to Cloudflare 1.1.1.1 and/or Google DoH. We do not run a nameserver and we do not store the domain.
What does ~all vs -all mean?: −all is fail (not authorized). ~all is softfail (not authorized, many inboxes still accept). +all authorizes the world and is almost always a mistake. ?all is neutral.
Why do I have multiple SPF records?: Two v=spf1 TXT strings are a permerror. Merge them: one record, several include: or ip4: terms. Do not publish a second SPF “to add Google.” Flatten or include instead.