Check your domain's SPF record in seconds. See which servers are allowed to send as you, whether the record is valid, and exactly what to publish if it is not.
We query your live DNS. Nothing to install, no signup to see your result.
Enter your domain and we query your live DNS. The checker verifies:
Each item returns pass, warn, or fail, with what to change when something is wrong.
SPF is a TXT record at your domain root. A typical record:
v=spf1 include:_spf.google.com ip4:203.0.113.25 -all
Mechanism reference:
| Part | Meaning |
|---|---|
| v=spf1 | Version tag. Required, must come first |
| ip4 / ip6 | An IP address or range allowed to send |
| include | Pull in another service's SPF (your ESP, CRM) |
| a / mx | Allow the domain's A or MX hosts |
| -all | Hard fail: everything not listed is unauthorized |
| ~all | Soft fail: not listed is probably not authorized |
| +all | Allows the entire internet to send as you. Never |
One rule that silently breaks large setups: SPF allows at most 10 DNS lookups per check. Every include, a, and mx costs lookups, and includes count what they include. RFC 7208 section 4.6.4 requires a permerror (permanent error) result once the limit is exceeded.
Missing record. With no SPF record, an SPF check of your domain returns none. RFC 7208 section 2.6.1 gives a none result when "no SPF records were retrieved from the DNS." Publish a record listing only the services that really send for you.
Choosing -all without checking DMARC. Start with ~all while you confirm every legitimate sender. If your DMARC record enforces (p=quarantine or p=reject, without t=y), we suggest you stay at ~all: RFC 9989 section 7.1 says that with -all, "messages that might otherwise pass DMARC due to an aligned DKIM-Authenticated Identifier (Section 4.4.1) could be rejected solely due to an SPF fail." If your DMARC record is p=none, move to -all once your DMARC reports show no real mail failing.
Too many lookups. Old includes from tools you no longer use pile up until the record needs more than 10. RFC 7208 section 4.6.4 requires a permerror (permanent error) result once the limit is exceeded.
SPF alone is not protection. SPF is checked against the envelope sender, not the From address your reader sees, and a forwarded message arrives from the forwarder's server, which your record does not list. DMARC checks that SPF or DKIM passed for a domain that aligns with the From address.
No SPF record. Publish a TXT record at your domain root listing your real senders, ending in ~all. Whether to move to -all later depends on your DMARC record: see "Choosing -all without checking DMARC" above.
Multiple SPF records. RFC 7208 section 4.5 requires a permerror (permanent error) result when more than one record is found. Merge into exactly one record.
+all or ?all. These authorize everyone or no one meaningfully. Replace either with ~all. Whether to go on to -all depends on your DMARC record: see "Choosing -all without checking DMARC" above.
Lookup limit exceeded. Remove includes for services you no longer use. Most domains need two or three includes, not eight.
A new sending service not added. Your CRM or outreach tool sends as you, your record does not list it, so its mail does not pass SPF. Add the provider's include, then re-check here.
This tool checks your DNS configuration. It does not measure where your mail lands, so it cannot tell you why mail lands where it does. Any tool that promises an inbox rate from a DNS check is guessing.
The full Humerly email setup audit checks MX, SPF, DKIM, DMARC, TLS-RPT, MTA-STS, BIMI, and blacklist status, then hands you a single Email Setup Score with a numbered fix plan.
Run the full setup auditWhat is an SPF record?
A TXT record in your DNS listing every server and service authorized to send email using your domain in the envelope sender.
What is the difference between ~all and -all?
With ~all, a server your record does not list gets a softfail result, which RFC 7208 section 2.6.5 calls "a weak statement by the publishing ADMD that the host is probably not authorized." With -all it gets a fail result, which section 2.6.4 calls "an explicit statement that the client is not authorized to use the domain in the given identity." If your DMARC record enforces (p=quarantine or p=reject, without t=y), we suggest staying at ~all, because RFC 9989 section 7.1 says that with -all, "messages that might otherwise pass DMARC due to an aligned DKIM-Authenticated Identifier (Section 4.4.1) could be rejected solely due to an SPF fail."
What is the 10 DNS lookup limit?
RFC 7208 section 4.6.4 limits SPF evaluation to 10 terms that cause DNS queries: the include, a, mx, ptr and exists mechanisms and the redirect modifier, counted through every include. Past 10, the same section requires a permerror result.
Does SPF stop spoofing by itself?
No. SPF validates the envelope sender, not the visible From address, and a forwarded message arrives from a server your record does not list. Pair it with DKIM and enforce with DMARC.
How long does an SPF change take to apply?
DNS changes typically propagate within minutes to a few hours, depending on your record's TTL.
Do subdomains inherit my SPF record?
No. Each subdomain that sends mail needs its own SPF record.