SPF Record Checker
Check a domain's SPF record the way receiving mail servers do. The checker follows every include, counts DNS lookups against the 10-lookup limit, flags void lookups and syntax errors, and tests whether a given IP may send.
SPF Record Checker
How this lookup works. When you press Check SPF, your browser sends the question over encrypted DNS-over-HTTPS to Cloudflare's public resolver (1.1.1.1), or to Google Public DNS (8.8.8.8) if you choose it below. The request goes straight from your device to them. It doesn't pass through ToolFeather: we have no server in the path, so we never see or store the names you look up. Requests are sent without cookies or a referrer. Each resolver has its own privacy policy: Cloudflare · Google.
Test a draft record before you publish it
Results appear here.
Queries your browser sent (0)
These are the exact requests, each one a link. Open one to see the raw JSON answer from the resolver.
Live lookup: your browser asks Cloudflare or Google DNS directly. Nothing passes through ToolFeather.
Scratchpad auto-saved
How it works — in four simple steps
No signup and nothing to install — it all runs in your browser.
Enter your domain
The domain in your Return-Path / envelope sender.
Optionally add an IP
To test whether a specific server may send.
Check SPF
Your browser follows every include through the resolver.
Fix the flagged issues
Each error links to the RFC rule it breaks.
Every include counts, and so does everything inside it. Google Workspace alone uses 4 of your 10 lookups.
Features
Exact lookup count
Counts include, a, mx, ptr, exists and redirect across the whole tree against the 10-lookup limit, and shows where the limit is crossed.
Void lookups and MX limits
Flags more than two void lookups and mx terms that expand to over ten hosts.
Test a sending IP
Runs RFC 7208 check_host() for any IPv4 or IPv6 address and explains the result.
Draft testing
Paste an unpublished record and check it live before changing DNS.
Include tree
Every nested include with its own record, lookups and resolved addresses.
All authorised ranges
The full list of IP ranges the record allows, ready to copy.
About the SPF Record Checker
SPF (Sender Policy Framework, RFC 7208) is a TXT record listing the servers allowed to send mail for a domain, for example v=spf1 include:_spf.google.com ip4:203.0.113.5 ~all. A receiving server takes the domain from the message's envelope sender (Return-Path), fetches the record and checks the connecting IP against each term in order. The first match decides the result: pass, fail (-), softfail (~) or neutral (?).
The rule most people trip over is the 10 DNS lookup limit (§4.6.4). Every include, a, mx, ptr, exists and redirect costs one lookup, and lookups inside included records count too. Google Workspace alone uses four, and Microsoft 365 two. Go past ten and receivers stop with a permerror, so SPF fails for all of your mail, including the legitimate kind. There's a second limit of two void lookups (names that return nothing), and each mx may expand to at most ten hosts. ip4, ip6 and all are free.
This checker walks the full tree from your browser and adds up the lookups across every branch. That worst-case total is the number that matters, because receivers stop early only when an IP matches. Enter an IP address to run the real check_host() evaluation, which stops at the first match like a mail server does and shows the path to the result. You can also paste a draft record to test it before you publish. Remember that SPF on its own doesn't protect the From: address people see. That takes DMARC.