Free SPF checker
We'll check whether your domain publishes one SPF record, the list of services allowed to send email for you. SPF helps stop other people sending fake emails in your name, but it doesn't stop every one on its own. This is a passive DNS look-up, for information only.
What this checks
This is a passive, light-touch check. It only reads what a normal browser visit and public DNS can see. It isn't a security test, a penetration test or a guarantee.
Check a site
Checking your site… This usually takes under a minute.
What your result means
- Pass: Your domain lists which services can send email for it.
- Worth a look: Your SPF record is there but too relaxed (?all), or close to the 10-lookup limit.
- Needs fixing: You have no SPF record, more than one, or one that lets anyone send as you (+all).
- How to fix: Add one SPF record at your domain provider that names your email service and ends in ~all or -all. Your email provider will give you the exact text. If you never send email from this domain, use v=spf1 -all.
FAQs
How many SPF records can I have?
Only one SPF TXT record on the domain. Extra ones break the check.
What do ~all and -all mean?
Both mark senders that aren't listed. `~all` is softer (soft fail); `-all` is stricter (fail). Your email provider will say which to use.
What is the 10-lookup limit?
SPF may follow at most 10 DNS look-ups. Too many `include:` mechanisms can push you over and make the record fail.
Does SPF stop all fake email?
No. It helps. Use it with DKIM and DMARC.