esc
↑↓ navigate ↵ open esc close

SPF Checker

Validate SPF DNS syntax, check a domain SPF record, parse mechanisms and count include-chain DNS lookups against the 10-lookup limit.

Examples google.com github.com cloudflare.com
SPF Record Valid TXT -all · HardFail
cloudflare.com
Published as a DNS TXT record · 205 characters · 1 of 1 SPF record
v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.mandrillapp.com include:mail.zendesk.com include:stspg-customer.com include:_spf.salesforce.com -all
DNS lookups
7 / 10
Mechanisms
9
Sending sources
8
7 of 10 DNS lookups
Validation
7 passed@if(data.warnCount) · 0 to review@end@if(data.failCount) · 0 failed@end
Exactly one SPF record published
A domain must publish a single v=spf1 TXT record — multiple records cause a PermError.
Pass
Starts with the v=spf1 version tag
The record opens with the correct, case-insensitive version token.
Pass
7 of 10 DNS lookups used
SPF permits at most 10 DNS-querying mechanisms before a PermError. You have 3 to spare.
Pass
Enforcement is -all (HardFail)
Unauthorised senders are rejected outright — the recommended strict policy.
Pass
No +all mechanism
The record does not authorise the entire internet to send mail as this domain.
Pass
No deprecated ptr mechanism
ptr is slow and discouraged by RFC 7208 — none present.
Pass
Each string under 255 characters
The record is 205 characters and fits in a single DNS TXT string.
Pass
Mechanisms
9 terms
QualifierMechanismValueDNS lookup
Pass ip4 199.15.212.0/22 —
Pass ip4 173.245.48.0/20 —
Pass include _spf.google.com +1
Pass include spf1.mcsv.net +1
Pass include spf.mandrillapp.com +1
Pass include mail.zendesk.com +1
Pass include stspg-customer.com +1
Pass include _spf.salesforce.com +1
Fail all -all —
DNS lookup chain
7 / 10 lookups
@if(node.kind === 'include')cloudflare.com v=spf1@elseif(node.kind === 'all')cloudflare.com v=spf1@elseif(node.kind === 'root')cloudflare.com v=spf1@elsecloudflare.com v=spf1@endif cost
├─ @if(node.kind === 'include')ip4:199.15.212.0/22@elseif(node.kind === 'all')ip4:199.15.212.0/22@elseif(node.kind === 'root')ip4:199.15.212.0/22@elseip4:199.15.212.0/22@endif 0
├─ @if(node.kind === 'include')ip4:173.245.48.0/20@elseif(node.kind === 'all')ip4:173.245.48.0/20@elseif(node.kind === 'root')ip4:173.245.48.0/20@elseip4:173.245.48.0/20@endif 0
├─ @if(node.kind === 'include')include:_spf.google.com@elseif(node.kind === 'all')include:_spf.google.com@elseif(node.kind === 'root')include:_spf.google.com@elseinclude:_spf.google.com@endif +1
│  ├─ @if(node.kind === 'include')ip4:74.125.0.0/16@elseif(node.kind === 'all')ip4:74.125.0.0/16@elseif(node.kind === 'root')ip4:74.125.0.0/16@elseip4:74.125.0.0/16@endif 0
│  ├─ @if(node.kind === 'include')ip4:209.85.128.0/17@elseif(node.kind === 'all')ip4:209.85.128.0/17@elseif(node.kind === 'root')ip4:209.85.128.0/17@elseip4:209.85.128.0/17@endif 0
│  ├─ @if(node.kind === 'include')ip6:2001:4860:4864::/56@elseif(node.kind === 'all')ip6:2001:4860:4864::/56@elseif(node.kind === 'root')ip6:2001:4860:4864::/56@elseip6:2001:4860:4864::/56@endif 0
│  ├─ @if(node.kind === 'include')ip6:2404:6800:4864::/56@elseif(node.kind === 'all')ip6:2404:6800:4864::/56@elseif(node.kind === 'root')ip6:2404:6800:4864::/56@elseip6:2404:6800:4864::/56@endif 0
│  ├─ @if(node.kind === 'include')ip6:2607:f8b0:4864::/56@elseif(node.kind === 'all')ip6:2607:f8b0:4864::/56@elseif(node.kind === 'root')ip6:2607:f8b0:4864::/56@elseip6:2607:f8b0:4864::/56@endif 0
│  ├─ @if(node.kind === 'include')ip6:2800:3f0:4864::/56@elseif(node.kind === 'all')ip6:2800:3f0:4864::/56@elseif(node.kind === 'root')ip6:2800:3f0:4864::/56@elseip6:2800:3f0:4864::/56@endif 0
│  ├─ @if(node.kind === 'include')ip6:2a00:1450:4864::/56@elseif(node.kind === 'all')ip6:2a00:1450:4864::/56@elseif(node.kind === 'root')ip6:2a00:1450:4864::/56@elseip6:2a00:1450:4864::/56@endif 0
│  ├─ @if(node.kind === 'include')ip6:2c0f:fb50:4864::/56@elseif(node.kind === 'all')ip6:2c0f:fb50:4864::/56@elseif(node.kind === 'root')ip6:2c0f:fb50:4864::/56@elseip6:2c0f:fb50:4864::/56@endif 0
│  └─ @if(node.kind === 'include')~all@elseif(node.kind === 'all')~all@elseif(node.kind === 'root')~all@else~all@endif 0
├─ @if(node.kind === 'include')include:spf1.mcsv.net@elseif(node.kind === 'all')include:spf1.mcsv.net@elseif(node.kind === 'root')include:spf1.mcsv.net@elseinclude:spf1.mcsv.net@endif +1
│  ├─ @if(node.kind === 'include')ip4:205.201.128.0/20@elseif(node.kind === 'all')ip4:205.201.128.0/20@elseif(node.kind === 'root')ip4:205.201.128.0/20@elseip4:205.201.128.0/20@endif 0
│  ├─ @if(node.kind === 'include')ip4:198.2.128.0/18@elseif(node.kind === 'all')ip4:198.2.128.0/18@elseif(node.kind === 'root')ip4:198.2.128.0/18@elseip4:198.2.128.0/18@endif 0
│  └─ @if(node.kind === 'include')?all@elseif(node.kind === 'all')?all@elseif(node.kind === 'root')?all@else?all@endif 0
├─ @if(node.kind === 'include')include:spf.mandrillapp.com@elseif(node.kind === 'all')include:spf.mandrillapp.com@elseif(node.kind === 'root')include:spf.mandrillapp.com@elseinclude:spf.mandrillapp.com@endif +1
│  ├─ @if(node.kind === 'include')ip4:198.2.128.0/24@elseif(node.kind === 'all')ip4:198.2.128.0/24@elseif(node.kind === 'root')ip4:198.2.128.0/24@elseip4:198.2.128.0/24@endif 0
│  ├─ @if(node.kind === 'include')ip4:198.2.132.0/22@elseif(node.kind === 'all')ip4:198.2.132.0/22@elseif(node.kind === 'root')ip4:198.2.132.0/22@elseip4:198.2.132.0/22@endif 0
│  ├─ @if(node.kind === 'include')ip4:198.2.136.0/23@elseif(node.kind === 'all')ip4:198.2.136.0/23@elseif(node.kind === 'root')ip4:198.2.136.0/23@elseip4:198.2.136.0/23@endif 0
│  ├─ @if(node.kind === 'include')ip4:198.2.145.0/24@elseif(node.kind === 'all')ip4:198.2.145.0/24@elseif(node.kind === 'root')ip4:198.2.145.0/24@elseip4:198.2.145.0/24@endif 0
│  ├─ @if(node.kind === 'include')ip4:198.2.186.0/23@elseif(node.kind === 'all')ip4:198.2.186.0/23@elseif(node.kind === 'root')ip4:198.2.186.0/23@elseip4:198.2.186.0/23@endif 0
│  ├─ @if(node.kind === 'include')ip4:205.201.131.0/24@elseif(node.kind === 'all')ip4:205.201.131.0/24@elseif(node.kind === 'root')ip4:205.201.131.0/24@elseip4:205.201.131.0/24@endif 0
│  ├─ @if(node.kind === 'include')ip4:205.201.134.128/25@elseif(node.kind === 'all')ip4:205.201.134.128/25@elseif(node.kind === 'root')ip4:205.201.134.128/25@elseip4:205.201.134.128/25@endif 0
│  ├─ @if(node.kind === 'include')ip4:205.201.136.0/23@elseif(node.kind === 'all')ip4:205.201.136.0/23@elseif(node.kind === 'root')ip4:205.201.136.0/23@elseip4:205.201.136.0/23@endif 0
│  ├─ @if(node.kind === 'include')ip4:205.201.139.0/24@elseif(node.kind === 'all')ip4:205.201.139.0/24@elseif(node.kind === 'root')ip4:205.201.139.0/24@elseip4:205.201.139.0/24@endif 0
│  ├─ @if(node.kind === 'include')ip4:198.2.177.0/24@elseif(node.kind === 'all')ip4:198.2.177.0/24@elseif(node.kind === 'root')ip4:198.2.177.0/24@elseip4:198.2.177.0/24@endif 0
│  ├─ @if(node.kind === 'include')ip4:198.2.178.0/23@elseif(node.kind === 'all')ip4:198.2.178.0/23@elseif(node.kind === 'root')ip4:198.2.178.0/23@elseip4:198.2.178.0/23@endif 0
│  ├─ @if(node.kind === 'include')ip4:198.2.180.0/24@elseif(node.kind === 'all')ip4:198.2.180.0/24@elseif(node.kind === 'root')ip4:198.2.180.0/24@elseip4:198.2.180.0/24@endif 0
│  └─ @if(node.kind === 'include')~all@elseif(node.kind === 'all')~all@elseif(node.kind === 'root')~all@else~all@endif 0
├─ @if(node.kind === 'include')include:mail.zendesk.com@elseif(node.kind === 'all')include:mail.zendesk.com@elseif(node.kind === 'root')include:mail.zendesk.com@elseinclude:mail.zendesk.com@endif +1
│  ├─ @if(node.kind === 'include')ip4:103.151.192.0/23@elseif(node.kind === 'all')ip4:103.151.192.0/23@elseif(node.kind === 'root')ip4:103.151.192.0/23@elseip4:103.151.192.0/23@endif 0
│  ├─ @if(node.kind === 'include')ip4:185.12.80.0/22@elseif(node.kind === 'all')ip4:185.12.80.0/22@elseif(node.kind === 'root')ip4:185.12.80.0/22@elseip4:185.12.80.0/22@endif 0
│  ├─ @if(node.kind === 'include')ip4:188.172.128.0/20@elseif(node.kind === 'all')ip4:188.172.128.0/20@elseif(node.kind === 'root')ip4:188.172.128.0/20@elseip4:188.172.128.0/20@endif 0
│  ├─ @if(node.kind === 'include')ip4:192.161.144.0/20@elseif(node.kind === 'all')ip4:192.161.144.0/20@elseif(node.kind === 'root')ip4:192.161.144.0/20@elseip4:192.161.144.0/20@endif 0
│  ├─ @if(node.kind === 'include')ip4:216.198.0.0/18@elseif(node.kind === 'all')ip4:216.198.0.0/18@elseif(node.kind === 'root')ip4:216.198.0.0/18@elseip4:216.198.0.0/18@endif 0
│  └─ @if(node.kind === 'include')~all@elseif(node.kind === 'all')~all@elseif(node.kind === 'root')~all@else~all@endif 0
├─ @if(node.kind === 'include')include:stspg-customer.com@elseif(node.kind === 'all')include:stspg-customer.com@elseif(node.kind === 'root')include:stspg-customer.com@elseinclude:stspg-customer.com@endif +1
│  ├─ @if(node.kind === 'include')ip4:23.253.182.103@elseif(node.kind === 'all')ip4:23.253.182.103@elseif(node.kind === 'root')ip4:23.253.182.103@elseip4:23.253.182.103@endif 0
│  ├─ @if(node.kind === 'include')ip4:23.253.183.145@elseif(node.kind === 'all')ip4:23.253.183.145@elseif(node.kind === 'root')ip4:23.253.183.145@elseip4:23.253.183.145@endif 0
│  ├─ @if(node.kind === 'include')ip4:23.253.183.146@elseif(node.kind === 'all')ip4:23.253.183.146@elseif(node.kind === 'root')ip4:23.253.183.146@elseip4:23.253.183.146@endif 0
│  ├─ @if(node.kind === 'include')ip4:23.253.183.147@elseif(node.kind === 'all')ip4:23.253.183.147@elseif(node.kind === 'root')ip4:23.253.183.147@elseip4:23.253.183.147@endif 0
│  ├─ @if(node.kind === 'include')ip4:23.253.183.148@elseif(node.kind === 'all')ip4:23.253.183.148@elseif(node.kind === 'root')ip4:23.253.183.148@elseip4:23.253.183.148@endif 0
│  ├─ @if(node.kind === 'include')ip4:23.253.183.150@elseif(node.kind === 'all')ip4:23.253.183.150@elseif(node.kind === 'root')ip4:23.253.183.150@elseip4:23.253.183.150@endif 0
│  ├─ @if(node.kind === 'include')ip4:166.78.68.221@elseif(node.kind === 'all')ip4:166.78.68.221@elseif(node.kind === 'root')ip4:166.78.68.221@elseip4:166.78.68.221@endif 0
│  ├─ @if(node.kind === 'include')ip4:167.89.46.159@elseif(node.kind === 'all')ip4:167.89.46.159@elseif(node.kind === 'root')ip4:167.89.46.159@elseip4:167.89.46.159@endif 0
│  ├─ @if(node.kind === 'include')ip4:167.89.64.9@elseif(node.kind === 'all')ip4:167.89.64.9@elseif(node.kind === 'root')ip4:167.89.64.9@elseip4:167.89.64.9@endif 0
│  ├─ @if(node.kind === 'include')ip4:167.89.65.0@elseif(node.kind === 'all')ip4:167.89.65.0@elseif(node.kind === 'root')ip4:167.89.65.0@elseip4:167.89.65.0@endif 0
│  ├─ @if(node.kind === 'include')ip4:167.89.65.53@elseif(node.kind === 'all')ip4:167.89.65.53@elseif(node.kind === 'root')ip4:167.89.65.53@elseip4:167.89.65.53@endif 0
│  ├─ @if(node.kind === 'include')ip4:167.89.65.100@elseif(node.kind === 'all')ip4:167.89.65.100@elseif(node.kind === 'root')ip4:167.89.65.100@elseip4:167.89.65.100@endif 0
│  ├─ @if(node.kind === 'include')ip4:167.89.74.233@elseif(node.kind === 'all')ip4:167.89.74.233@elseif(node.kind === 'root')ip4:167.89.74.233@elseip4:167.89.74.233@endif 0
│  ├─ @if(node.kind === 'include')ip4:167.89.75.33@elseif(node.kind === 'all')ip4:167.89.75.33@elseif(node.kind === 'root')ip4:167.89.75.33@elseip4:167.89.75.33@endif 0
│  ├─ @if(node.kind === 'include')ip4:167.89.75.126@elseif(node.kind === 'all')ip4:167.89.75.126@elseif(node.kind === 'root')ip4:167.89.75.126@elseip4:167.89.75.126@endif 0
│  ├─ @if(node.kind === 'include')ip4:167.89.75.136@elseif(node.kind === 'all')ip4:167.89.75.136@elseif(node.kind === 'root')ip4:167.89.75.136@elseip4:167.89.75.136@endif 0
│  ├─ @if(node.kind === 'include')ip4:167.89.75.164@elseif(node.kind === 'all')ip4:167.89.75.164@elseif(node.kind === 'root')ip4:167.89.75.164@elseip4:167.89.75.164@endif 0
│  ├─ @if(node.kind === 'include')ip4:192.237.159.42@elseif(node.kind === 'all')ip4:192.237.159.42@elseif(node.kind === 'root')ip4:192.237.159.42@elseip4:192.237.159.42@endif 0
│  ├─ @if(node.kind === 'include')ip4:192.237.159.43@elseif(node.kind === 'all')ip4:192.237.159.43@elseif(node.kind === 'root')ip4:192.237.159.43@elseip4:192.237.159.43@endif 0
│  ├─ @if(node.kind === 'include')ip4:159.112.242.162@elseif(node.kind === 'all')ip4:159.112.242.162@elseif(node.kind === 'root')ip4:159.112.242.162@elseip4:159.112.242.162@endif 0
│  ├─ @if(node.kind === 'include')ip4:159.135.228.10@elseif(node.kind === 'all')ip4:159.135.228.10@elseif(node.kind === 'root')ip4:159.135.228.10@elseip4:159.135.228.10@endif 0
│  ├─ @if(node.kind === 'include')ip4:198.244.56.107@elseif(node.kind === 'all')ip4:198.244.56.107@elseif(node.kind === 'root')ip4:198.244.56.107@elseip4:198.244.56.107@endif 0
│  ├─ @if(node.kind === 'include')ip4:198.244.56.108@elseif(node.kind === 'all')ip4:198.244.56.108@elseif(node.kind === 'root')ip4:198.244.56.108@elseip4:198.244.56.108@endif 0
│  ├─ @if(node.kind === 'include')ip4:198.244.56.109@elseif(node.kind === 'all')ip4:198.244.56.109@elseif(node.kind === 'root')ip4:198.244.56.109@elseip4:198.244.56.109@endif 0
│  ├─ @if(node.kind === 'include')ip4:198.244.56.111@elseif(node.kind === 'all')ip4:198.244.56.111@elseif(node.kind === 'root')ip4:198.244.56.111@elseip4:198.244.56.111@endif 0
│  ├─ @if(node.kind === 'include')ip4:198.244.56.112@elseif(node.kind === 'all')ip4:198.244.56.112@elseif(node.kind === 'root')ip4:198.244.56.112@elseip4:198.244.56.112@endif 0
│  ├─ @if(node.kind === 'include')ip4:198.244.56.113@elseif(node.kind === 'all')ip4:198.244.56.113@elseif(node.kind === 'root')ip4:198.244.56.113@elseip4:198.244.56.113@endif 0
│  ├─ @if(node.kind === 'include')ip4:198.244.56.114@elseif(node.kind === 'all')ip4:198.244.56.114@elseif(node.kind === 'root')ip4:198.244.56.114@elseip4:198.244.56.114@endif 0
│  ├─ @if(node.kind === 'include')ip4:198.244.56.115@elseif(node.kind === 'all')ip4:198.244.56.115@elseif(node.kind === 'root')ip4:198.244.56.115@elseip4:198.244.56.115@endif 0
│  ├─ @if(node.kind === 'include')ip4:204.220.181.105@elseif(node.kind === 'all')ip4:204.220.181.105@elseif(node.kind === 'root')ip4:204.220.181.105@elseip4:204.220.181.105@endif 0
│  └─ @if(node.kind === 'include')~all@elseif(node.kind === 'all')~all@elseif(node.kind === 'root')~all@else~all@endif 0
├─ @if(node.kind === 'include')include:_spf.salesforce.com@elseif(node.kind === 'all')include:_spf.salesforce.com@elseif(node.kind === 'root')include:_spf.salesforce.com@elseinclude:_spf.salesforce.com@endif +1
│  ├─ @if(node.kind === 'include')exists:%{i}._spf.mta.salesforce.com@elseif(node.kind === 'all')exists:%{i}._spf.mta.salesforce.com@elseif(node.kind === 'root')exists:%{i}._spf.mta.salesforce.com@elseexists:%{i}._spf.mta.salesforce.com@endif +1
│  └─ @if(node.kind === 'include')-all@elseif(node.kind === 'all')-all@elseif(node.kind === 'root')-all@else-all@endif 0
└─ @if(node.kind === 'include')-all@elseif(node.kind === 'all')-all@elseif(node.kind === 'root')-all@else-all@endif 0
Total DNS lookups7 / 10
Raw TXT record
cloudflare.com.        3600    IN    TXT    "v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.mandrillapp.com include:mail.zendesk.com include:stspg-customer.com include:_spf.salesforce.com -all"
Guide

Reading an SPF record

SPF (Sender Policy Framework) is a single DNS TXT record that lists which servers are allowed to send mail for your domain. This SPF record checker reads the published v=spf1 value, validates SPF DNS syntax, and explains every mechanism in the sender policy.

The most common failure is the 10-lookup limit: every include, a, mx, ptr, exists and redirect term costs a DNS query, and nested includes count too. Cross 10 and the whole record returns a PermError. The ip4 and ip6 terms are free, so flatten stable includes into ranges where you can.

SPF helps receivers evaluate whether the connecting server is authorized, but it is not a complete anti-spoofing system by itself. Pair SPF with DKIM and a DMARC policy so receivers can also evaluate domain alignment and reporting.

FAQ

Frequently asked questions

What is an SPF record checker?

An SPF record checker validates a domain TXT record that starts with v=spf1. It parses mechanisms such as include, ip4, ip6, a, mx, redirect, and all so you can understand the authorized mail sender policy.

What is the SPF 10 DNS lookup limit?

RFC 7208 caps SPF evaluation at 10 DNS-querying mechanisms, including include, a, mx, ptr, exists, and redirect. Nested includes count toward the same budget; exceeding it causes a PermError.

Should I use ~all or -all?

Start with ~all while confirming every legitimate sender is listed, then move to -all when ready. SPF alone does not guarantee inbox placement, so pair it with DKIM and DMARC alignment.

Why can I only have one SPF record?

Publishing more than one v=spf1 TXT record creates a PermError. Merge all authorized senders into a single SPF record using mechanisms such as include, ip4, ip6, a, and mx.