# SPF record checker

> An SPF record checker looks up the TXT record that starts with v=spf1 on your domain and tests it. It confirms there is exactly one SPF record, that the syntax is valid, that it stays within the limit of 10 DNS lookups, and that it ends in a clear policy such as ~all or -all. You can check any domain free with the SPF checker on this page.

This site is run by Vigilbase (https://vigilbase.com), a managed security provider. It covers: spf record checker.

## Run the check

- In the browser: https://spfrecordchecker.com/ (results shown on the page)
- API: POST https://api.vigilbase.com/tools/v1/agent/tools/email-security/execute with {"target":"example.com"}

## What does an SPF record checker test?

- That the domain publishes one SPF record. Two v=spf1 records make SPF fail outright.
- That every mechanism (include, a, mx, ip4, ip6, redirect) is valid syntax.
- The number of DNS lookups. More than 10 causes a permerror and receivers treat the record as broken.
- The final qualifier: -all rejects unlisted senders, ~all marks them, and +all lets anyone send as you.
- Whether each include still resolves. Old includes for tools you stopped using waste lookups.

## How to fix the most common SPF errors

Too many lookups: remove includes for services that no longer send for you, and replace stable senders with their ip4 or ip6 ranges where the provider publishes them.

Multiple records: merge them into a single v=spf1 record. DNS hosts often add a second one when you connect a new mail tool.

Ending in +all or ?all: change it to ~all while you confirm every sender is listed, then move to -all.

A valid SPF record for a domain that sends through Google Workspace and one marketing tool:

```
example.com.  TXT  "v=spf1 include:_spf.google.com include:sendgrid.net ~all"
```

## SPF qualifiers at a glance

| Ending | Meaning | When to use it |
| --- | --- | --- |
| -all | Hard fail: reject mail from unlisted servers | Once DMARC reports show every real sender passes |
| ~all | Soft fail: accept but mark as suspicious | While you are still finding all your senders |
| ?all | Neutral: no opinion | Rarely useful; gives receivers nothing to act on |
| +all | Pass everything | Never. Anyone can send as your domain |

## SPF is one of three checks

SPF says which servers may send for your domain. DKIM signs each message, and DMARC tells receivers what to do when SPF or DKIM fails. Mailbox providers such as Google and Yahoo expect all three from bulk senders, so check DKIM and DMARC after SPF.

## FAQ

### What is the SPF 10 DNS lookup limit?

RFC 7208 limits SPF evaluation to 10 mechanisms that need a DNS lookup (include, a, mx, ptr, exists and redirect). Past 10, receivers return a permerror and SPF fails, even if your sending server is listed.

### Should my SPF record end in -all or ~all?

Use ~all (soft fail) while you confirm every service that sends for you is listed. Once DMARC reports show nothing legitimate failing, -all (hard fail) gives the strongest signal. Never use +all.

### Can a domain have two SPF records?

No. A domain must publish exactly one v=spf1 TXT record. Two records cause a permerror, so merge them into one.

### Is this SPF checker free?

Yes. The check runs on vigilbase.com at no cost and needs no account.

## Related

- [Run the free email security check](https://vigilbase.com/tools/email-security)
- [Build a new SPF record](https://vigilbase.com/tools/spf-generator)
- [Full email security check](https://vigilbase.com/tools/email-security)
- [SPF record generator](https://vigilbase.com/tools/spf-generator)
- [DMARC record generator](https://vigilbase.com/tools/dmarc-generator)
- [MTA-STS checker](https://vigilbase.com/tools/mta-sts-checker)
- [BIMI checker](https://vigilbase.com/tools/bimi-checker)