Look up and parse a domain’s v=spf1 record. Highlights includes, redirect, the all-qualifier, and warns when the apex publishes more than one SPF (an RFC-violation that breaks delivery).
Enter a value above to run a lookup.
Sender Policy Framework (SPF) is a TXT record that tells receiving mail servers which IPs are allowed to send email for your domain. Receivers cross-check the sending IP against your SPF policy and may reject or quarantine mismatches.
-all = hardfail (reject anything not listed). ~all = softfail (mark suspicious but accept, often the safer default during rollout). ?all = neutral (no policy), and +all is dangerous (allow anything). Production domains should run -all once SPF is stable.
RFC 7208 caps SPF at 10 DNS lookups. include: and redirect= each consume lookups, so chains like "include:_spf.google.com include:sendgrid.net include:mailgun.org" can hit the limit and silently break for some receivers.
No. RFC 7208 forbids it; receivers will treat the domain as having no SPF policy. The checker flags this with multiple_records=true.
It’s a partial fix. SPF only validates the envelope sender (Return-Path) and can be bypassed by simple forwarding. Pair SPF with DKIM and DMARC for real anti-spoofing.