netlupaCheck a domain's SPF record
SPF says which servers may send email for your domain. Enter it to review its syntax and how many DNS lookups it uses.
How to read an SPF record
An SPF record is a TXT record that starts with «v=spf1» followed by a list of mechanisms evaluated left to right. For example:
- v=spf1 include:_spf.google.com ip4:203.0.113.10 -all
It means: authorize Google's servers and the IP 203.0.113.10, and reject everything else. Each mechanism can be prefixed with a qualifier: + (pass, the default), - (fail), ~ (soft fail) or ? (neutral).
The most important limit is the 10 DNS lookups: include, a, mx, ptr, exists and redirect use one each, including those inside includes. Go over it and SPF fails, as if you had none. The tool counts them all for you.
Each record in detail
Frequently asked questions
How do I add a new provider to my SPF?
Add its include to the record you already have, before the final «all», for example: v=spf1 include:_spf.google.com include:sendgrid.net ~all. Do not create a second SPF record: with two, it fails.
What if I exceed 10 lookups?
Remove includes for services you no longer use, replace what you can with their ip4/ip6 blocks or use a separate subdomain with its own SPF for bulk sending.
What is my DKIM selector?
Open an email you sent, view its source or original headers and look for DKIM-Signature: the «s=» value is the selector and «d=» the domain. Google Workspace usually uses «google» and Microsoft 365 «selector1» and «selector2».
Is «~all» or «-all» better?
With DMARC in place the practical difference is small, because the DMARC policy decides. «-all» is stricter; «~all» is more forgiving with forwarding and forgotten services. Without DMARC, «-all» protects more.
I changed my DNS and the tool does not see it. Why?
DNS records are cached for as long as their TTL says (often one hour). Wait that long and check again. Also make sure the record is on the right name (for example, _dmarc.yourdomain.com for DMARC).
Do I need SPF and DMARC on a domain that sends no email?
Yes, it is highly recommended: publish «v=spf1 -all» and «v=DMARC1; p=reject;» so nobody can use that domain to send fake emails.
Do you store the domains I check?
No. We query public DNS at that moment, with our own resolver, and store neither the domain nor the result.