Check an SPF record, or build one
SPF fails quietly. It works for a year, someone adds one more service, the record goes over the limit of ten DNS lookups, and from that moment every receiver treats it as broken — with no error anywhere. This shows you the count.
- Runs from your browser, not our server
- No sign-up
- No watermark
Loading the tool…
How it works
- Type your domain. Add an IP if you want to know whether that specific server is allowed to send.
- Read the result, the lookup count and the findings; open the tree to see what each included record actually contains.
- Use the builder below to assemble a correct record from the services you really use.
Why nothing is uploaded
Every operation on this page is done by code running inside your browser tab, using the same engine that renders web pages. The file is read from disk into your tab’s memory, transformed there, and written back out as a download. It is never sent anywhere — not to us, not to a third party.
Verify it yourself
- Open your browser’s developer tools (F12) and select the Network tab.
- Load your file and run the tool.
- The only requests you will see fetch the tool’s own code — and, for a few heavy tools, their open-source engine from a public CDN — plus one small page-view ping to loreatec.jp (page address and title, nothing more). None of them carry your file.
Frequently asked questions
What is the ten-lookup limit exactly?
Each include, a, mx, ptr, exists and redirect costs one DNS lookup, and the ones inside the records you include count too. The standard (RFC 7208) caps the total at ten. A receiver that reaches the cap stops and returns an error, which most treat as if you had no SPF at all. Providers whose one include hides three or four more lookups are the usual cause. The fix: drop services you no longer use, or replace includes with plain IP addresses — carefully, since those lists go out of date.
Why is +all so bad?
Because it authorises every server on the internet to send as your domain. It is worse than publishing nothing: with no record, a receiver falls back on other signals; with +all, you have explicitly vouched for the spammer. It usually appears when someone copies an example and changes the wrong character.
Should the record end in -all or ~all?
-all means “reject anything else”, ~all means “treat anything else with suspicion”. Start at ~all while you are still finding out what sends for you, then move to -all. The difference only matters once DMARC is in place — DMARC is the rule that tells the receiver what to do with a failed check, and a DMARC policy of reject with SPF ~all still rejects. Do not stay on ~all forever out of caution; it is a stopover, not a destination.
Can I have two SPF records?
No. Two v=spf1 records on the same name is a permanent error, and receivers stop evaluating. It happens when a service asks you to “add this record” and you add a second TXT instead of merging its entries into the one you have.
What does this send to whom?
The domain names being looked up go to the public DNS service you selected, from your browser. This site’s server is not involved and keeps no record of anything.