DNS authentication diagnostic

SPF record checker

Look up a domain's Sender Policy Framework record and inspect the published sending policy.

What does SPF do?

SPF is a DNS-based policy that tells receiving systems which servers are allowed to send mail for a domain. It is one part of email authentication alongside DKIM and DMARC.

What this checker confirms

The tool reads public TXT records and identifies entries beginning with v=spf1. A published SPF record does not guarantee inbox placement, but missing or broken authentication can contribute to delivery problems.

Put the result to work

Read the published sender policy before testing a message

The SPF checker reads the published TXT policy and flags a limited set of record issues. It does not recursively evaluate includes or determine whether a specific sending IP is authorised.

  1. Enter the sending domain

    Use the domain for the policy you are investigating.

  2. Inspect the policy text

    Look for duplicate records, permissive all mechanisms and reported top-level issues.

  3. Compare with real mail

    Inspect received message headers to see the receiver’s SPF result for an actual sender.

Worked examples

What the evidence tells you

Illustrative scenarios, not live results for the addresses or records shown. Open a scenario to see the next action.

01v=spf1 -all
No sending hosts authorised by this policy

This can be intentional for a domain that sends no mail.

Next action Do not copy it onto an active sending domain.

02Two separate v=spf1 records
Conflicting policies

Multiple SPF records need review; adding another record is not the way to add a sender.

Next action Follow your provider’s instructions for one combined policy.

03One include term
Not a full lookup count

An include may lead to more lookups. This tool counts only top-level lookup-causing terms.

Next action Use sender-aware evaluation for the entire chain.

Use it with a purpose

Where this tool fits

Adding another mail sender

Check whether an SPF record already exists before publishing a new one.

Reviewing a DNS edit

Look for supported policy mistakes before inspecting a message sent through the service.

Before you decide

Questions about this tool

Does it check the SPF lookup limit completely?

No. Nested includes, macros and runtime sender-IP evaluation are outside this tool’s scope.

Does SPF validate the visible From address by itself?

SPF evaluates an envelope or HELO identity. DMARC adds alignment with the visible author domain.

Does a found record mean SPF passed?

No. A pass or failure is determined for a particular message and sending host.

Technical reference: SPF specification.