Check your domain's SPF record in seconds. See which servers are allowed to send as you, whether the record is valid, and exactly what to publish if it is not.
We query your live DNS. Nothing to install, no signup to see your result.
Enter your domain and we query your live DNS. The checker verifies:
Each item returns pass, warn, or fail, with the exact record to publish when something is wrong.
SPF is a TXT record at your domain root. A typical record:
v=spf1 include:_spf.google.com ip4:203.0.113.25 -all
Mechanism reference:
| Part | Meaning |
|---|---|
| v=spf1 | Version tag. Required, must come first |
| ip4 / ip6 | An IP address or range allowed to send |
| include | Pull in another service's SPF (your ESP, CRM) |
| a / mx | Allow the domain's A or MX hosts |
| -all | Hard fail: everything not listed is unauthorized |
| ~all | Soft fail: not listed is suspicious, not blocked |
| +all | Allows the entire internet to send as you. Never |
One rule that silently breaks large setups: SPF allows at most 10 DNS lookups per check. Every include, a, and mx costs lookups, and includes count what they include. Cross the limit and receivers get a permanent error, which reads as no SPF at all.
Missing record. Anyone can put your domain in the envelope sender and no receiver is told to stop them. Publish a record listing only the services that really send for you.
~all forever. Soft fail is the correct starting point while you confirm every legitimate sender. It is not the destination. Once your DMARC reports show no real mail failing, move to -all.
Too many lookups. The most common invisible breakage. Old includes from abandoned tools pile up until the record crosses 10 and the whole thing stops evaluating.
SPF alone is not protection. SPF is checked against the envelope sender, not the From address your reader sees, and it breaks on forwarding. That is why DKIM and DMARC exist. Passing all three, aligned, is what receivers actually trust.
No SPF record. Publish a TXT record at your domain root listing your real senders, ending in ~all while you monitor, then -all.
Multiple SPF records. Receivers treat this as a permanent error. Merge into exactly one record.
+all or ?all. These authorize everyone or no one meaningfully. Replace with ~all, then -all.
Lookup limit exceeded. Remove includes for services you no longer use. Most domains need two or three includes, not eight.
A new sending service not added. Your CRM or outreach tool sends, SPF does not list it, mail fails. Add the provider's include, then re-check here.
This tool checks your DNS configuration. It does not measure where your emails land, because placement depends on how your domain behaves over time, not on a record lookup. Any tool that promises an inbox rate from a DNS check is guessing.
A correct SPF record is one of the entry tickets. Reputation is the rest of the game.
The full Humerly email setup audit checks MX, SPF, DKIM, DMARC, TLS-RPT, MTA-STS, BIMI, and blacklist status, then hands you a single Email Setup Score with a numbered fix plan.
Run the full setup auditWhat is an SPF record?
A TXT record in your DNS listing every server and service authorized to send email using your domain in the envelope sender.
What is the difference between ~all and -all?
~all marks unlisted senders as suspicious but deliverable. -all tells receivers to reject them. Start with ~all, confirm your real senders through DMARC reports, then tighten to -all.
What is the 10 DNS lookup limit?
SPF evaluation may perform at most 10 DNS lookups. include, a, mx, redirect and exists mechanisms all count, recursively. Exceeding it is a permanent error and your SPF stops working entirely.
Does SPF stop spoofing by itself?
No. SPF validates the envelope sender, not the visible From address, and forwarding breaks it. Pair it with DKIM and enforce with DMARC.
How long does an SPF change take to apply?
DNS changes typically propagate within minutes to a few hours, depending on your record's TTL.
Do subdomains inherit my SPF record?
No. Each subdomain that sends mail needs its own SPF record.