Check a domain's SPF record

See which servers a domain authorizes to send email, and whether the policy is strict enough to matter.

Free and anonymous. No account required.

What this checks

This reads the SPF TXT record on the domain and parses its mechanisms and final 'all' qualifier (-all hardfail, ~all softfail, ?all/+all).

Why it matters

SPF declares which servers may send mail for a domain. A softfail or missing record weakens the protection DMARC relies on, leaving room for spoofing.

How the detection works

A live DNS-over-HTTPS query retrieves the record; a deterministic parser classifies it strong, weak, or missing with recommendations.

FAQ

What is a strong SPF record?

One that ends in '-all' (hardfail), so unauthorized senders are rejected rather than merely flagged.

Does SPF replace DMARC?

No. SPF and DKIM are inputs to DMARC, which decides what to do when they fail. You want all three.

Related free checks

Email breach check DMARC checker DKIM checker Domain age check Lookalike domain finder WHOIS lookup Meeting link safety check Shared link safety check

Want continuous monitoring?

Connect your inbox and InboxWatch watches for these threats automatically. Free for your first 15 scans.

Connect your inbox