SPF Lookup
Parse & validate the Sender Policy Framework record.
Enter a value above to run SPF Lookup
e.g. example.com
Quick answer
SPF Lookup reads a domain's Sender Policy Framework record and shows which servers are authorized to send email for that domain, helping prevent spoofing. It parses each mechanism (such as ip4, include, and a) and flags common problems like exceeding the 10 DNS-lookup limit or a missing all qualifier.
SPF Lookup fetches the TXT record that starts with "v=spf1" from a domain and breaks it down mechanism by mechanism, so you can see exactly which servers are authorized to send mail as that domain. SPF is one of the three pillars of email authentication alongside DKIM and DMARC. A missing, malformed, or overly broad record leads to messages landing in spam or being rejected outright. This tool parses each term, resolves nested includes, and flags the errors that quietly break delivery.
How it works
The tool queries the domain's TXT records and locates the one beginning with v=spf1. It then walks each mechanism left to right: a, mx, ip4, ip6, include, and the final all qualifier. For include and redirect terms it follows the referenced domains and counts how many DNS lookups the full evaluation requires. The output shows the raw record, the parsed tokens, and any syntax or limit warnings in one view.
How to read the results
Read the qualifier on each mechanism: + means pass, - means hard fail, ~ means soft fail, and ? means neutral. The ending -all rejects everything not listed, while ~all marks it as suspicious but still delivers. Watch the DNS lookup counter closely: SPF allows a maximum of 10 lookups, and mechanisms like include and mx each consume from that budget. Exceeding it produces a permerror that invalidates the whole record.
Common problems & fixes
The most frequent failure is too many DNS lookups, usually from stacking several third-party includes; flatten unused ones or consolidate providers. Publishing two separate v=spf1 records is invalid, as only one is permitted per domain, so merge them into a single line. Also avoid a bare +all, which authorizes the entire internet to send as you. Replace it with -all or ~all once you have listed every legitimate sender.
Frequently asked questions
- What is the difference between -all and ~all?
- Both apply to senders not listed in your record. -all is a hard fail that tells receivers to reject unauthorized mail outright. ~all is a soft fail that marks it as suspicious but usually still delivers. Start with ~all while testing, then tighten to -all once you are confident every legitimate sending source is included.
- Why does my SPF record fail with a permerror?
- A permerror almost always means your record required more than 10 DNS lookups during evaluation, or it contains a syntax mistake like two v=spf1 records or an unknown mechanism. Each include, a, mx, and redirect adds to the lookup count. Reduce third-party includes or flatten them to IP ranges to get back under the limit.
- Does SPF alone stop email spoofing?
- No. SPF only validates the envelope sender (the return-path), not the visible From address readers see, so it can be bypassed on its own. Pair it with DKIM for message signing and DMARC to tie authentication to the From domain and set an enforcement policy. The three together give you meaningful protection against spoofing.