Start free
ProductHow it worksPlatform tourSafety and controlsYour first 30 daysCompetitor trackingLinkedIn signalsDone for youHubSpotSalesforceSmartleadAll integrationsFounder-led salesBefore the first SDRAccount-based marketingClosed-lost reactivation
Free toolsFree ICP assessmentSandbox workspaceSPF, DKIM and DMARC checkOutbound cost calculatorB2B outbound glossaryRoast my cold emailOutlevo CommunityICP generatorCold email generatorSubject line graderEmail word checkerBlacklist checkUse it from Claude, Cursor, LovableDeveloper hubAPI reference
IntegrationsFor AI buildersPricingResources
Theme
Log inStart free

Free · no sign-up

SPF record checker

Paste a domain. We read its SPF record live, count the DNS lookups it costs, and tell you what to change. DNS lookups only; nothing about your domain is stored.

What an SPF record is

SPF is a TXT record on your domain that lists the servers allowed to send mail whose envelope sender is that domain. A receiving server looks the record up, compares the connecting IP address, and decides pass or fail. It is checked per domain name: a subdomain does not inherit its parent's record.

Two things trip up most cold email setups. Every tool that sends for you has to be in the one record, and the record can only cost so many DNS lookups.

PartWhat it does
v=spf1Starts every SPF record. A TXT record that does not start with it is not SPF.
include:_spf.google.comAuthorizes whatever that domain's own SPF record authorizes. This is how Google Workspace, Microsoft 365 and sending tools are added. Each include costs a lookup, plus the lookups inside it.
ip4:203.0.113.7 or ip6:…Authorizes one address or range directly. Costs no lookup.
a, mxAuthorizes the addresses of your own A or MX records. Each costs a lookup.
~all or -allWhat to do with every other sender: ~all soft-fails them, -all fails them. Ends the record. ?all is neutral and +all authorizes everyone.

Common errors and how to fix them

  • Two SPF records
    RFC 7208 says a domain with more than one SPF record gets a permerror result. It is the most common mistake after adding a new sending tool: someone publishes a second record instead of editing the first.
    Fix: Merge them into one record, with every include in it.
  • More than 10 lookups
    RFC 7208 limits an SPF check to 10 terms that cause DNS lookups. The count includes the lookups inside every include, which is why a few tools can add up fast. Past the limit the check fails with a permerror, as if you had no SPF.
    Fix: Remove includes for tools you no longer use, replace includes with ip4: where a provider's addresses are stable, or send the tool's mail from a subdomain with its own record.
  • Ending in +all
    +all authorizes every server on the internet to send as you, which makes the record pointless.
    Fix: End the record with ~all while you are still finding senders, then -all.
  • The ptr mechanism
    RFC 7208 says the ptr mechanism should not be published. It is slow and costs lookups.
    Fix: Replace it with include: or ip4: terms for the senders you actually use.
  • A sender is missing
    Mail from a tool that is not in the record fails SPF even though the record is valid. Look at the Authentication-Results header of a message it sent.
    Fix: Add the include the tool documents, in the same record.
  • No SPF record at all
    Receivers have nothing to check, and mail from a new domain with no authentication is the easiest to reject.
    Fix: Publish one TXT record starting with v=spf1.

Examples

Illustrative records, not yours. Use the includes your own providers document.

One mailbox provider, one sending tool

v=spf1 include:_spf.google.com include:sendgrid.net ~all

A fixed server plus a provider, strict ending

v=spf1 ip4:203.0.113.7 include:_spf.google.com -all

Broken: two records for one domain

v=spf1 include:_spf.google.com ~all
v=spf1 include:sendgrid.net ~all

Questions

Should I end in ~all or -all?
Both are valid. ~all asks receivers to treat other senders as suspicious; -all asks them to fail it. Many teams start with ~all and move to -all once every sender is known. With DMARC in place, the difference matters less.
Does SPF stop spoofing on its own?
No. SPF checks the envelope sender, not the From address a person sees, and it breaks when mail is forwarded. DMARC ties the check to the visible From domain, which is why the three records are set up together.
What do the 10 lookups count?
RFC 7208 limits an SPF check to 10 terms that cause DNS lookups. Our checker counts include, redirect, a, mx, ptr and exists terms, following each include, the way the limit is counted.
Do I need SPF on a domain that only sends cold email?
Yes, and on every sending domain, not only your main one. Each domain you send from needs its own record.
Do you store what I check?
No. The check is a set of DNS lookups answered on the spot; only a rate-limit counter for your network is kept.

The other checks

DKIM

The signature that proves a message was not changed.

DMARC

What receivers do with mail that fails both.

MX

Where replies to your domain are delivered.

All four at once

The full SPF, DKIM, DMARC and MX check.

Blocklist

Is a sending address on a public blocklist?

Outlevo checks this before every campaign

A sender whose SPF fails is held, with the reason, until it is fixed.

Start in the sandboxFind my buyers, free →