DMARCdrift
ProductPricingDocsBlogToolsSign inGet started
Sign in
← All toolsLive DNS lookup

SPF Record Checker

Enter any domain to see its SPF record, parsed mechanisms, DNS lookup count, and specific recommendations.

Live lookup, no account required. Monitor DMARC alignment across all your senders.

See plans →

How SPF protects your deliverability

SPF is the first layer of email authentication. It tells receiving servers which IP addresses are allowed to send mail for your domain. If your SPF record is misconfigured (wrong includes, too many DNS lookups, a missing sender), DMARC alignment fails and your mail either gets filtered or your policy has no teeth. This tool does a live lookup of your SPF record, counts your DNS lookups, and flags common mistakes before they affect deliverability. If you're configuring authentication from the start, our guide to setting up email for a new SaaS covers SPF alongside DKIM and DMARC.

Common SPF issues this tool catches

  • Too many lookups:SPF allows a maximum of 10 DNS lookups. Exceeding it causes a permerror.
  • Missing senders:ESPs like Resend, SendGrid, or Mailgun not included in your record
  • Multiple SPF records:only one SPF TXT record is valid per domain; duplicates cause failures
  • Wrong all mechanism:+all authorizes every server in the world; most records should end with ~all or -all

Frequently asked questions

What is an SPF record?
An SPF (Sender Policy Framework) record is a DNS TXT record that lists which mail servers are authorized to send email for your domain. When a receiving server gets a message claiming to be from your domain, it checks your SPF record to see if the sending IP is on the list. A pass contributes to DMARC alignment; a fail is a signal that the mail may not be legitimate.
How do I check my SPF record?
Enter your domain above and click Check. The tool performs a live DNS lookup, parses every mechanism in your record, counts the DNS lookups required, and flags configuration issues. You'll see which IPs and includes are authorized and whether your record is valid.
What does SPF fail mean?
SPF fails when the sending server's IP address isn't listed in your SPF record. This can happen because an ESP wasn't added (e.g., you started using Resend but didn't add include:_spf.resend.com), or because the record has too many DNS lookups and returned a permerror. An SPF fail doesn't automatically block mail. It depends on your DMARC policy, but it does mean SPF won't contribute to alignment.
How many DNS lookups does SPF allow?
Exactly 10. Each include:, a:, mx:, and redirect= mechanism that requires a DNS query counts toward the limit. ESPs chain their own includes, so a single include:_spf.google.com can consume multiple lookups. Exceeding 10 results in a permerror, which some receivers treat as a hard fail.

SPF alone doesn't show the full picture.

DMARCdrift shows your complete DMARC alignment across all sending sources: which senders are passing SPF, which are passing DKIM, and which are failing both. Know what's actually happening with your domain's email authentication.

Get started free →

Monitor your SPF record, get alerted when lookup counts change.

See plans →