Look up any domain's SPF record and see, for free, whether it is valid: the raw record, its ~all or -all enforcement, the DNS-lookup count against the 10 limit, and errors like a stray +all or a duplicate record. No sign-up.
SPF (Sender Policy Framework) is a single TXT record in your domain's DNS that lists which mail servers may send email as your domain. When a message arrives, the receiving server looks up your SPF record and checks the sending server's IP against it. If the sender is not authorized, the message can be marked suspicious or rejected. SPF is one of the three pillars of email authentication: SPF says who may send, DKIM cryptographically signs the message, and DMARC ties them to the visible From address and decides what happens on failure.
An SPF record is v=spf1 followed by mechanisms that authorize senders, ending in an all catch-all. These are the ones you will see in a real record.
| Mechanism | What it does |
|---|---|
| include: | Authorize another domain's senders (e.g. include:_spf.google.com for Google Workspace). Each include: costs one of the 10 DNS lookups. |
| a / a:domain | Authorize the domain's own A/AAAA records to send. Costs one lookup. |
| mx / mx:domain | Authorize the domain's mail servers (its MX hosts) to send. Costs one lookup. |
| ip4: / ip6: | Authorize a specific IP or CIDR range directly. Free: it needs no DNS lookup. |
| redirect= | Hand the whole SPF decision to another domain's record. Costs one lookup and replaces any all mechanism. |
| all | The catch-all at the end that decides every sender not matched above. Its qualifier is what makes SPF strict or loose. |
The qualifier on the final all decides every sender your record does not explicitly list. It is the single most important character in your SPF record.
| Qualifier | What it tells receivers |
|---|---|
| -all (fail) | Reject any sender not listed. The strictest and recommended ending once every legitimate sender is included. |
| ~all (softfail) | Accept but mark unlisted senders as suspicious. The common safe default, especially while you finish listing senders. |
| ?all (neutral) | Neither pass nor fail. Offers almost no protection; treat it as a temporary state, not a destination. |
| +all (pass) | Authorize the entire internet to send as your domain. This defeats SPF completely and should never be published. |
Type any domain (like acme.com). The checker reads its public DNS. You can also paste an email or URL and it extracts the domain.
See the raw record, its enforcement qualifier, the DNS-lookup count against the 10 limit, and each authorized sender, with any error called out.
Adjust the TXT record at your DNS host, then run the check again. DNS can take a little while to propagate, so re-check after a few minutes.
Yes, completely, and it needs no sign-up. It reads your domain's public DNS to find and parse the SPF record, counts the DNS lookups against the 10 limit, and flags common errors. There is nothing to install and nothing to pay.
SPF (Sender Policy Framework) is a TXT record in your domain's DNS that lists which mail servers are allowed to send email as your domain. Receiving servers check the sending server's IP against your SPF record; if it is not authorized, the message can be marked suspicious or rejected. SPF is one of the three pillars of email authentication, alongside DKIM and DMARC.
The qualifier on the final 'all' mechanism decides what happens to senders your record does not list. -all (hardfail) tells receivers to reject them, ~all (softfail) tells them to accept but flag them, ?all is neutral, and +all authorizes everyone (never use it). Start at ~all while you confirm every legitimate sender passes, then tighten to -all.
RFC 7208 caps an SPF evaluation at 10 DNS lookups. Mechanisms like include:, a, mx, exists: and redirect= each consume one; ip4: and ip6: are free. Go over 10 and receivers return a permerror and ignore SPF entirely, so a record that looks correct silently stops working. The checker counts your lookups so you can flatten includes before you hit the limit.
No. A domain must publish exactly one SPF (v=spf1) record. Two or more is an error: receivers see a permerror and disregard SPF. If you use several providers, merge their include: mechanisms into a single record. The checker flags a domain that has published more than one.
No, and this is the common misunderstanding. SPF authorizes sending servers, but it checks the hidden envelope sender, not the From address a person sees, and it breaks on forwarding. Only DMARC ties SPF (and DKIM) to the visible From domain and tells receivers what to do on failure. Publish SPF and DKIM, then enforce them with DMARC.
The usual causes are the 10-lookup limit (too many include: mechanisms), a second SPF record published by accident, a stray +all, or a sender you forgot to include. This tool surfaces the first three directly; for a missing sender, check that every service you send through (your ESP, CRM, helpdesk, invoicing) appears in an include:.
PeopleSearch.im finds the professionals you describe in plain English and their verified professional emails, so your outreach reaches a real inbox.
