Free SPF Lookup

01 · Definition

What is spf lookup?

An SPF lookup — or SPF record check — reads the Sender Policy Framework record published as a TXT record on your domain. SPF tells receiving mail servers which IPs and hostnames are allowed to send mail using your domain in the envelope sender. When a receiver sees a message claiming to be from noreply@yourdomain.com, it does an SPF lookup on yourdomain.com and decides whether to accept, soft-fail or reject.

The tool above resolves the domain's TXT records, locates the v=spf1 entry, and displays the raw record alongside the final qualifier (-all, ~all, ?all) and a count of the direct DNS-lookup-consuming mechanisms. Read the SPF lookup guide for a full walkthrough of SPF record syntax, common errors, and how to interpret the results.

02 · Process

How it works

1. 1Query the TXT records.Resolve yourdomain.com for TXT records and find the one starting with v=spf1. There must only be one.
2. 2Parse every mechanism.Split the record into its components: ip4:, ip6:, include:, a, mx, exists:, redirect: and all. The tool counts any mechanism that triggers a further DNS query — include:, a, mx, exists:, ptr: and redirect: — toward the RFC 7208 limit of ten.
3. 3Count DNS lookups.RFC 7208 caps the chain at 10. Going over triggers a permerror and receivers will treat the message as if SPF doesn't exist — exactly the case attackers want.
4. 4Read the final qualifier.-all rejects unauthorised senders. ~all soft-fails (commonly junk-foldered). ?all and +all effectively disable SPF and should never appear in production.

03 · Risk

Why it matters

SPF is one third of the modern email-authentication baseline (SPF, DKIM, DMARC). Without it, any sender can spoof your domain into the inbox. With it misconfigured — too many lookups, missing senders, an over-permissive qualifier — the protection is theatre, not real.

04 · Use cases

Common ways to use this tool

• Pre-launch audit. Before a new sending domain goes live, confirm SPF is published and within the lookup limit.
• Vendor onboarding. When you add a new ESP or transactional provider, verify their include: string is present and the chain didn't push you over 10 lookups.
• DMARC rollout. Verify SPF alignment matches your DMARC policy direction — start at p=none, then move toward p=quarantine and p=reject with confidence.
• Spoofing investigation. When customers report phishing claiming to come from your domain, an SPF lookup confirms whether the attacker's IPs would pass or fail.
• Mergers and migrations. Two firms combining brands need to consolidate sending infrastructure without dropping any legitimate sender on day one.

05 · Interpretation

What to check in the result

The tool returns four things — read them in this order:

• Lookup count under 10. If the count is at or above 10, SPF is failing for some receivers right now. Trim or flatten include: chains.
• Single record. If you see two records starting v=spf1, SPF will permerror immediately. Merge them.
• No +all or ?all. Either qualifier accepts unauthorised senders. Move to ~all while learning, -all in production.
• Every legitimate sender represented. Marketing ESPs, transactional providers, billing systems, payroll, calendar invites — each needs its own include: or IP. Missing senders silently lose mail.