Bitelio
§ T-04  —  Tool← All tools

SPF record
checker

Pull up any domain's SPF record and see exactly what it authorizes — a mechanism-by-mechanism breakdown that flags mistakes before they dent your deliverability.

SPF record lookup

Enter the domain without http:// or www.

§ 01SPF explained

SPF, from the ground up.

It's your domain's first barrier against spoofed and phishing mail.

Authorise senders

Publishing an SPF record declares which servers may send as your domain. Anything not on that list fails the check.

Prevent spoofing

An SPF record gives receiving servers the evidence they need to spot forged mail and turn it away — without one, impersonation goes undetected.

10 lookup limit

Each evaluation may trigger at most 10 DNS lookups. Go over and you get a PermError that breaks SPF outright — so keep an eye on the count.

SPF is not enough alone

The check applies to the envelope sender, not the From header users actually read. DMARC is the layer that connects SPF (and DKIM) results to the visible sender and blocks spoofing.

One record only

Exactly one v=spf1 TXT record per domain — no more. Duplicates produce a PermError, so fold every sending source into a single record.

Hard fail vs softfail

-all (hard fail) tells receivers to reject unlisted senders outright; ~all (softfail) merely flags them. Move to -all in production once your sender list is complete.

SPF, DKIM, DMARC — without the homework.

Domain authentication comes with guided setup, and your sending reputation is watched around the clock. Free to start — no credit card required.

Start with BitelioWhat is SPF?

Frequently asked questions

What is an SPF record?

SPF (Sender Policy Framework) is a DNS TXT record naming every mail server allowed to send email for your domain. When a message arrives claiming to come from you, the receiving server consults that list to confirm the sending server is genuinely authorised. With no SPF record published, nothing stops anyone from putting your domain in the From address.

What does -all vs ~all mean?

-all is a hard fail: receivers should reject any mail from servers not in your record. ~all is a softfail: mismatched mail gets marked suspicious but still delivered. Once every legitimate sending source is listed, production domains should move to -all.

Why is there a 10 DNS lookup limit?

The 10-lookup cap comes from RFC 7208 and exists to keep SPF evaluation from being abused for DNS flooding or denial-of-service. Each include, a, mx, ptr, and exists mechanism consumes one lookup, and going past 10 produces a PermError — which in practice means SPF stops working for your domain.

Can I have multiple SPF records?

No — a domain gets exactly one SPF (v=spf1) TXT record. Publishing two or more triggers a PermError and breaks authentication entirely. When several services need to send for you, merge their mechanisms into one combined record.

Does SPF alone protect against spoofing?

Not by itself. SPF checks the envelope sender (the "Return-Path" address), which recipients never see — the visible "From" header goes unchecked. Pairing SPF (and DKIM) with DMARC is what ties authentication to the From header and actually blocks spoofing of your visible sender address.