DomainCanary Start free

SPF record checker

Enter your domain to see how many DNS lookups your SPF record uses. A receiving server makes at most 10, so mail from any sender it needs an eleventh lookup to find fails SPF.

An SPF record lists the mail servers permitted to send email for your domain as a DNS TXT record starting with v=spf1. Receiving servers test the sender's IP against this list to decide whether to accept or flag incoming mail. Use our SPF record generator to construct a clean record.

This lookup only shows what you published in DNS. Your DMARC reports show which of your real senders pass, and we read them to decide when each step toward p=reject is safe.

DMARC enforcement with automatic rollback

Get your domain to p=reject without blocking your own mail

We read your DMARC reports and email you each step once they show it's safe. You approve every step. When a sender you marked as yours sends enough mail to measure and a step starts blocking it, we put the previous policy back.

  1. p=nonereports only
  2. p=quarantineyou approve
  3. p=rejectyou approve

Rollback needs hosted DMARC, on the Starter plan and up. You can try it free for 30 days with no card. Rollback works in the days after each step, and it can't bring back mail a receiver already refused. How rollback works

Create your account

Continue with Google

or

Free for your first domain · No card · Per-source totals kept for life

MSPs can group domains by client.

Questions

What is the difference between -all, ~all, and +all in SPF?

With -all, unlisted senders fail SPF. With ~all, unlisted senders get an SPF softfail. The receiver decides whether to accept or reject the mail. With ?all or +all, you get almost no protection. With +all, you've said every mail server on the internet may send for your domain.

What is the SPF 10-lookup limit?

Under RFC 7208, an SPF record allows at most 10 DNS-querying mechanisms, including include, a, mx, ptr, exists, and redirect. This cap includes nested lookups inside vendor records. Read our guide to the SPF 10-lookup limit to see how quickly third-party includes consume your budget.

What happens when an SPF record exceeds 10 lookups?

Receivers read the record left to right and stop at the first match. A sender they need an eleventh lookup to find gets a PermError, so its mail fails SPF. Senders they find within ten lookups still pass SPF. Check our directory of SPF records for popular services and review common DNS errors.

How do you know which SPF includes are safe to remove?

This checker resolves your full lookup chain, so you can see the includes nested inside your own before delivery breaks. On the Business plan and up, we check each include against 90 days of your aggregate reports and mark it keep, review, or remove by the mail it sent.

The other tools

DMARC checkerFree, no signup. DKIM checkerFree, no signup. SPF, DKIM and DMARC checkerFree, no signup. DMARC report analyzerFree, no signup. Paste the XML. SPF record generatorFree, no signup. Merges, never replaces. DMARC record generatorFree, no signup. Keeps your existing tags. SPF change pre-flightFree, no signup. Diff a record before you publish it. Email header analyzerFree, no signup. Paste the headers of one message.