Free tool · No signup
SPF checker: look up and test your SPF record.
Enter your domain to find its SPF record, count the DNS lookups it triggers against the limit of 10, and see the fix for anything wrong. Free, no signup, about two seconds.
Opens at the SPF result, inside the full report for your domain: MX, SPF, DKIM, DMARC, 9 blacklists and domain age, graded 0 to 100.
The basics
What an SPF record does
SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers allowed to send email as you. Receivers check it on every message. Gmail asks bulk senders for SPF, DKIM and DMARC, so a broken SPF record is one of the first reasons cold email lands in spam.
What this check looks at
- There is exactly one v=spf1 TXT record at the root of the domain. Two or more is a permanent error for receivers.
- The DNS lookups the record triggers, counted against the limit of 10. Over the limit, SPF fails for every message.
- How the record ends: ~all (soft fail) or -all (hard fail) protect you; +all lets anyone send as you; ?all or no all mechanism protects nothing.
- A record that hands off to another domain with redirect= counts as valid.
Problems and fixes
What the checker can find, and the fix it gives you.
| Problem | Fix |
|---|---|
| No SPF record | Add a TXT record at the root, for example "v=spf1 include:_spf.google.com ~all" for Google Workspace. |
| Two or more SPF records | Merge them into a single v=spf1 record. |
| More than 10 DNS lookups | Remove includes for services you no longer use, or flatten the record, to get under 10 lookups. |
| Ends with +all, ?all or nothing | End the record with "~all" (soft fail) or "-all" (hard fail). |
Example records
- Google WorkspaceTXT
@v=spf1 include:_spf.google.com ~all - Microsoft 365TXT
@v=spf1 include:spf.protection.outlook.com -all - BothTXT
@v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all
The honest part
What this check can't tell you.
A passing SPF record proves the server may send for you. It says nothing about your list, your copy or your sending volume, which decide most of where cold email lands.
More free checks
Check the rest of your setup.
- Full domain check MX, SPF, DKIM, DMARC, 9 blacklists and domain age in one report, graded 0 to 100.
- MX lookup Free MX lookup: see your domain's MX records in priority order, which provider receives your mail, and whether its mail servers are on 6 IP blacklists. No signup.
- DMARC checker Free DMARC checker: find your DMARC record, read its policy and report address, and get the exact fix. Gmail and Yahoo require DMARC from bulk senders.
- DKIM checker Free DKIM checker: we look for your DKIM key on 23 common selectors (Google, Microsoft 365, Zoho and more) or your own. No signup.
- Blacklist check Free blacklist check: your domain on Spamhaus DBL, SURBL, URIBL, and your mail servers on 6 IP lists including Spamhaus ZEN. Results in seconds, no signup.
Questions
Ballast is cold email software with every feature on every plan. Connect unlimited mailboxes, send sequences at a pace your domains survive, and handle replies in one inbox, priced by the emails you send.
What is the SPF 10 lookup limit?
Every include:, a, mx, ptr, exists and redirect in an SPF record makes the receiver do a DNS lookup, and includes inside includes count too. Past 10, the check fails with a permanent error and SPF fails for every message. Remove services you no longer use, or flatten the record.
Should my SPF record end with ~all or -all?
Either protects you. ~all (soft fail) asks receivers to treat other senders with suspicion; -all (hard fail) asks them to reject. Never use +all, which lets anyone send as you.
Can a domain have two SPF records?
No. Two v=spf1 records are a permanent error and receivers treat SPF as failed. Merge everything into one record.
Does a passing SPF record get my emails into the inbox?
No. SPF only proves the sending server is allowed to send for your domain. Inbox placement also depends on DKIM, DMARC, your sending volume, your list and your copy.
Ballast runs this check every night.
For every domain you send from, with sending that pauses before a problem costs you the inbox. Every feature on every plan, from $19 a month.