Get a free API key

FFraudFree toolsSPF checker

Check an SPF record before it fails.

Type a domain or an email address. The checker reads the domain's SPF record the way receiving mail servers do: every term, every include followed, the lookups counted, and anything that breaks it.

SPF for microsoft.com

Valid SPF record

7 of 10 DNS lookups · unlisted servers fail

TXT microsoft.com

v=spf1 include:_spf-a.microsoft.com include:_spf-b.microsoft.com include:_spf-c.microsoft.com include:_spf-ssg-a.msft.net include:_spf1-meo.microsoft.com -all

  1. include:_spf-a.microsoft.comEvery server _spf-a.microsoft.com lists in its own SPF record. · 2 lookups
  2. include:_spf-b.microsoft.comEvery server _spf-b.microsoft.com lists in its own SPF record. · 2 lookups
  3. include:_spf-c.microsoft.comEvery server _spf-c.microsoft.com lists in its own SPF record. · 1 lookup
  4. include:_spf-ssg-a.msft.netEvery server _spf-ssg-a.msft.net lists in its own SPF record. · 1 lookup
  5. include:_spf1-meo.microsoft.comEvery server _spf1-meo.microsoft.com lists in its own SPF record. · 1 lookup
  6. -allEvery other server fails: receivers may reject its mail.

SPF works with DMARC, which tells receivers what to do with mail that fails: check it with the DMARC checker. Where the domain receives mail: the MX lookup.

Behind every check

24.6 million
IP addresses profiled
2.7 million
malicious domains tracked
228,000
disposable email domains
2.3 million
networks scored

Counts read live from the engine, not written into the page. The full dataset is published on GitHub under the MIT license and rebuilt every 30 minutes.

What an SPF record does

SPF (Sender Policy Framework) lets a domain publish the servers allowed to send its mail, in one TXT record. A receiving server compares the server a message came from with that list and gets a result: pass, fail, soft fail or neutral. SPF checks the envelope sender, the address bounces go to; DMARC ties it to the From address people see.

ip4 and ip6

Servers listed by address or range.

include

Another domain's list, pulled in whole. Mail providers give their customers one to add, such as include:_spf.google.com.

a and mx

The servers the domain's own address or mail records point at.

all

What every server not on the list gets: -all fails it, ~all soft-fails it, ?all leaves it neutral.

redirect

Hands the whole check to another domain's record.

The limit of 10 DNS lookups

Receivers stop after 10 DNS lookups. Every include, a, mx, ptr, exists and redirect costs one, and so does every include inside an include. A record that needs more returns a permanent error, and SPF then fails for every message, the legitimate ones included. Adding one more email service is the usual way a record crosses the line. The checker follows every include and counts the total.

The mistakes that break SPF

Two SPF records on one domain, which happens when a new provider's record is added next to the old one instead of merged into it. More than 10 lookups. An include that points at a domain with no SPF record. A typo in a mechanism. And +all, which passes every server on the internet and makes the record worthless. Each of these gets its own line in the result.

Questions people ask.

A tool that reads a domain's SPF record and tells you whether receiving mail servers can use it: the servers it allows, the DNS lookups it needs and any error that makes SPF fail. Type a domain above to check one.

Use -all once every service that sends your mail is in the record, so other servers fail outright. The soft fail, ~all, is the safer start while you are still finding senders. With a DMARC policy at quarantine or reject the difference matters less, because DMARC then decides what happens to mail that fails.

Remove includes for services that no longer send your mail, replace an include with the ip4 or ip6 ranges behind it when the provider publishes stable ones, and move a high-volume sender to a subdomain with its own SPF record. Drop ptr, which costs a lookup and is discouraged anyway.

No. Receivers return a permanent error when they find more than one, so SPF fails for all mail. Merge them into one record that starts with v=spf1 and ends with a single all.

No. SPF checks the envelope sender, which people never see, so a forger can pass SPF with a domain of their own while showing yours in the From line. DMARC closes that gap by requiring the checked domain to match the visible one.

One line of text in a TXT record at the domain, for example v=spf1 include:_spf.google.com ip4:203.0.113.10 -all: Google's servers and one address may send, and every other server fails.

Other free tools.

DMARC checker

Check a domain's DMARC policy, where its reports go, and the mistakes that stop it working.

Open

DKIM checker

Find a domain's DKIM keys under the common selectors or your own, and check their type, length and status.

Open

MX lookup

See a domain's MX records, the mail service behind them, and whether FFraud lists the domain as disposable.

Open

Every free tool

Do it in code.

The same answer from a free API endpoint, with the reason, the recency and the network around the address. Or download the confirmed blocklist for bulk blocking. No card, no quota, no expiry.

Get a free API keyDownload the data