Look up and check a domain’s SPF record, free and instant.
Every other tool on this site runs entirely as JavaScript in your browser and never contacts a server at all. This one is a deliberate exception, by necessity: the domain you enter is sent to this site’s server to run the DNS TXT lookup — unavoidable, since browsers can’t query DNS directly — using this server’s own DNS resolution, with no third-party service involved. Nothing about the request is logged, stored, written to a cookie, or shared with any third party — it's handled and discarded the moment the response is sent back to you.
This describes only what this specific tool does with what you type into it. It doesn't cover the rest of this site — see the Privacy Policy for how analytics and advertising cookies are handled elsewhere.
SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are allowed to send email on a domain's behalf — it's one of the main defenses against someone spoofing your domain in the "From" address of a phishing email. Every serious email deliverability setup (Google Workspace, Microsoft 365, a transactional email service like SendGrid or Amazon SES) requires getting this record right, and the raw syntax is dense enough that a small mistake is easy to miss reading it by eye.
This tool fetches a domain's SPF record (if one exists) and breaks down what it actually authorizes — which mail providers, which IP ranges, and what the record says to do with mail that doesn't match (the qualifier at the end, commonly a "soft fail" or "hard fail" policy).
A domain can only have one SPF record. If you've added a service's required SPF text as a brand new TXT record instead of merging it into your existing one, most receiving mail servers only read the first, which is a very common real-world email deliverability bug.
They check different things and work together — SPF authorizes specific sending servers, DKIM cryptographically signs the message, and DMARC tells receiving servers what to do if either check fails. Most modern deliverability setups need SPF and DKIM at minimum, with DMARC layered on top.
No — having more than one SPF TXT record is invalid per the spec and typically causes mail servers to reject or distrust all of them. If you need to add a new sender, merge it into your single existing record instead.
~all is a "soft fail" (unauthorized mail is flagged/suspicious but often still delivered); -all is a "hard fail" (unauthorized mail should be rejected outright). Most production setups eventually move to -all once they’re confident every real sending source is included.
Yes — both describe looking up and evaluating a domain’s SPF record, which is what this tool does.