SPF Checker: Check SPF, DKIM and DMARC for Any Domain
Use this free SPF checker tool to check the SPF record for any domain, along with its DKIM and DMARC records. Enter a domain, add your DKIM selector if you know it, and see which records are set, which are missing or need work, and how to fix them. Strong email authentication stops spoofing and helps your email reach the inbox.
Free · no sign-upWhat is an SPF record?
An SPF (Sender Policy Framework) record is a TXT record in your domain's DNS that lists the servers allowed to send email for your domain. Receiving mail servers check it to decide whether a message that claims to be from you is genuine.
Here is a typical SPF record:
v=spf1 include:_spf.google.com ip4:203.0.113.10 ~all| Part | What it means |
|---|---|
v=spf1 | Marks the TXT record as an SPF record. |
include: | Allows another service's servers, such as your email provider, to send for you. |
ip4: / ip6: | Allows a specific server IP address. |
~all | Soft fail: mail from other servers is suspicious and usually goes to spam. |
-all | Hard fail: mail from other servers should be rejected. |
How to check the SPF record for a domain
- Enter your domain, for example example.com.
- Add your DKIM selector (optional). Your email provider can tell you what it is.
- Press Check email security.
- Fix anything marked Missing or Needs work, wait for DNS to update, then check again.
Common SPF problems and how to fix them
| Problem | Why it matters | Fix |
|---|---|---|
| Two SPF records | Receivers may ignore SPF completely. | Merge them into one record. |
| More than 10 DNS lookups | SPF returns an error (permerror) and fails. | Remove services you no longer use and reduce include: entries. |
No ~all or -all at the end | Receivers don't know what to do with other senders. | End the record with ~all or -all. |
+all | Allows any server in the world to send as you. | Never use it. Replace it with ~all or -all. |
| No SPF record | Anyone can spoof your domain more easily. | Add a TXT record that lists your email providers. |
SPF and DKIM checker: how SPF, DKIM and DMARC work together
| Standard | What it does | Where it lives |
|---|---|---|
| SPF | Lists which servers may send email for your domain. | A TXT record on your domain |
| DKIM | Adds a cryptographic signature that proves the message came from your domain and wasn't changed. | A public key in DNS under a selector name |
| DMARC | Tells receivers what to do when SPF and DKIM fail (none, quarantine or reject) and where to send reports. | A TXT record at _dmarc.yourdomain |
Finding your DKIM selector
We test common selector names automatically. If DKIM shows as not found, enter your provider's selector: Google Workspace usually uses google, and Microsoft 365 uses selector1 and selector2. You can also find it in any email you sent: open the message headers and look for s= in the DKIM-Signature line.
Recommended path to full protection
- Start with DMARC p=none and reporting turned on, so you can see who sends email as you.
- Fix your legitimate senders so they all pass SPF or DKIM.
- Move to p=quarantine, so failing mail goes to spam.
- Finish with p=reject, so spoofed mail is blocked.
Since 2024, Gmail and Yahoo have required bulk senders to use SPF, DKIM and DMARC, and Microsoft introduced similar rules for Outlook.com in 2025.
Next: check all your DNS records
See your MX, TXT and NS records in one place to confirm your email setup is complete.
Email Security Checker FAQ
What is an SPF checker?
An SPF checker looks up a domain's SPF record and tells you whether it exists, whether it is valid and what to fix. This tool also checks DKIM and DMARC.
How do I check the SPF record for a domain?
Enter the domain in this SPF checker and press Check email security. The SPF result shows the record and any problems found.
Can I have two SPF records?
No. Merge them into a single record, otherwise receivers may ignore SPF.
What is the difference between ~all and -all?
~all is a soft fail: mail from unlisted servers is treated as suspicious. -all is a hard fail: that mail should be rejected. Many domains start with ~all and move to -all once every sender is listed.
Why is DKIM "not found" when my email works?
We only test common selector names. Enter your provider's selector, for example google, selector1 or k1, to check it.
Is DMARC p=none good enough?
It's a safe starting point because it only monitors. It doesn't stop spoofing until you move to quarantine or reject.
Do SPF, DKIM and DMARC improve deliverability?
Yes. Gmail, Yahoo and Microsoft expect email authentication, particularly from bulk senders.
More free security tools
DNS Lookup
A, AAAA, MX, NS, TXT, CNAME, SOA and CAA records.
Open tool →Suspicious URL Checker
Spot phishing signs in a link before you click it.
Open tool →SSL/TLS Checker
Certificate expiry, trust status, protocol and cipher.
Open tool →Security Headers Checker
Grade the HTTP security headers of a website.
Open tool →IP Lookup
Location, ISP, ASN and reverse DNS for any IPv4 or IPv6 address.
Open tool →VPN & Proxy Checker
Find out if an IP belongs to a VPN, proxy or data center.
Open tool →