SPF Record Checker:
Validate Your Domain’s Authorized Senders
A misconfigured SPF record can send legitimate email straight to Spam or leave a domain open to spoofing. Most teams only find out after a delivery failure or after a fraudulent email surfaces.
Sendmarc’s SPF record checker fetches your domain’s live SPF record, checks its syntax, and lists every server authorized to send on your behalf, so you can catch the problem before it affects deliverability or security.
Enter your domain below to check its current SPF record.
What Is an SPF Record Checker?
An SPF record is a DNS entry that lists the servers authorized to send email for a domain. An SPF record checker retrieves that record, parses its syntax, and confirms whether it’s configured correctly.
IT administrators use an SPF record checker to confirm a DNS change took effect after adding a new sending service. Security teams use it to audit which servers are authorized to send on a domain’s behalf. Marketing and communications teams use it to troubleshoot deliverability issues.
yourdomain.com · TXT
v=spf1 include:_spf.google.com include:spf.thirdparty.com ip4:192.0.2.1 ~all
How an SPF Record Works
- An SPF record is published as a DNS TXT entry attached to a domain. When a receiving server gets an email, it looks up that record and checks whether the sending server’s IP address is on the authorized list.
- The record is built from mechanisms and qualifiers. An
includemechanism authorizes a third-party service, such as an email marketing platform, to send on the domain’s behalf. Anip4orip6mechanism authorizes a specific server directly. - The final qualifier, usually
~allor-all, tells receiving servers how to treat any sender not explicitly listed. This is why a single missingincludestatement, or a leftover entry for a service the organization no longer uses, is enough to cause authentication to fail or leave a gap attackers can use.
Why SPF Matters
Without a valid SPF record, any server can attempt to send email that appears to come from your domain. That gap is what attackers exploit for spoofing and phishing.
A misconfigured SPF record also affects legitimate email. Gmail, Outlook, and other mailbox providers check SPF before deciding whether a message reaches the inbox or lands in Spam.
SPF also has a technical limit on DNS lookups. Records with too many mechanisms can exceed that limit, causing authentication to fail even when every listed sender is legitimate. For enterprises running multiple business units, regions, and third-party platforms, that limit is easy to hit without realizing it.
Common Use Cases
- After adding a new senderConfirm a new marketing platform, CRM, or helpdesk tool is correctly included after a DNS update.
- Investigating deliverability issuesCheck whether a missing or failed SPF record explains why legitimate email is landing in Spam.
- Routine domain auditsReview which servers are currently authorized to send on a domain’s behalf, and remove ones that no longer apply.
- Ahead of a compliance reviewConfirm SPF is correctly published before an audit or risk committee asks for evidence of email authentication controls.
What Sendmarc’s SPF Record Checker
Shows You
Record status
Whether an SPF record exists for the domain and is published correctly in the DNS.
TXT · v=spf1 include:_spf.google.com include:spf.thirdparty.com ip4:192.0.2.1 ~all
Authorized senders
Lists the IP addresses and third-party services permitted to send on the domain’s behalf.
DNS lookup count
Counts the lookups the record triggers. Most mechanisms count toward it.
How to Use Sendmarc’s SPF Record Checker
- Enter the domain. Type the domain name into the tool.
- Run the lookup. Select Lookup. The tool fetches the record directly from the domain’s DNS.
- Review the record. See the current SPF record, authorized senders, and any included third-party services.
- Check for issues. Look for missing senders or a DNS lookup count near the limit.
Once you know what a healthy SPF record looks like, spotting a missing sender or a high lookup count becomes routine. Run a check any time you add a new sending service, or when deliverability drops without an obvious cause.
Run the check to see where your domain currently stands.
SPF Record Checker FAQs
What does a valid SPF record look like?
A valid SPF record follows a specific syntax published as a DNS TXT entry. For example:
| Host | Type | Value |
|---|---|---|
@ | TXT | v=spf1 ip4:192.0.2.1 include:spf.thirdparty.com ~all |
v=spf1declares the record versionip4:192.0.2.1authorizes a specific IP addressinclude:spf.thirdparty.comauthorizes a third-party service~allmarks any unlisted sender as a soft failure
What happens if my SPF record is incorrect?
An incorrect SPF record, caused by syntax errors or a missing sender, affects both deliverability and security. Messages can be sent to Spam or rejected, and the domain becomes more vulnerable to spoofing.
How do I fix an SPF misconfiguration?
Fixing an SPF misconfiguration starts with running an SPF check to identify issues such as invalid syntax or a missing sender. Update the DNS TXT record to correct the error and confirm all legitimate senders are included, then re-run the check to validate the change.
How does SPF affect my email deliverability?
SPF affects email deliverability by letting receiving servers verify that a message came from a server authorized to send for that domain. Without a valid SPF record, legitimate email can be marked as Spam or rejected outright.
Can a domain have more than one SPF record?
No, a domain shouldn’t have more than one SPF record. Multiple records cause authentication to fail. All authorized senders need to be combined into a single record.
Do I need SPF if I already have DKIM?
Yes, SPF is still necessary even with DKIM in place. SPF authenticates the sending server, while DKIM verifies the message content wasn’t altered in transit. Full protection requires SPF, DKIM, and DMARC working together.
Does an SPF record checker stop spoofed email from arriving?
No. An SPF record checker validates the record’s configuration. Blocking unauthenticated email before it reaches an inbox requires full DMARC enforcement, which uses SPF and DKIM results to tell receiving servers what to do with messages that fail.