Yellaro

SPF record checker

Free SPF record checker

Check whether your SPF record is set up correctly and lists the right sending servers. We look up your SPF, DKIM, and DMARC and explain each in plain English. No signup.

How SPF works

SPF (Sender Policy Framework) is a single TXT record in your DNS that lists which mail servers are allowed to send email for your domain. When a receiving server gets a message claiming to be from you, it reads your SPF record and checks whether the server that actually sent it is authorized. If not, the message is treated as a likely forgery.

The record ends with an all mechanism that decides what happens to servers you did not list. This qualifier is the part most people get wrong:

  • -all Hardfail. Receivers reject mail from any server not on your list. The strictest setting, safe once every legitimate sender is included.
  • ~all Softfail. Unlisted servers are accepted but treated as suspicious. The common, safe default while you confirm your senders.
  • ?all Neutral. No opinion on unlisted servers, so it offers little real protection.
  • +all Pass. Allows any server on the internet to send as you. This defeats SPF entirely and should never be used.

SPF also has a hard limit: every include, a, mx, ptr, exists, and redirect mechanism costs a DNS lookup, and the total cannot exceed 10. Go over and SPF fails with a permerror, even when the rest of the record is correct. Chaining one include per sending service is the usual way domains quietly cross that line. The checker above flags this when it sees too many lookups.

DKIM

DKIM adds a cryptographic signature to each message so receivers can confirm it really came from your domain and was not altered on the way.

DMARC

DMARC ties SPF and DKIM together and tells inbox providers what to do with mail that fails: monitor it, send it to spam, or reject it.

Looking for something specific? Check your SPF, DKIM, or DMARC record.

Keeping SPF, DKIM, and DMARC healthy is the part that quietly eats your time, and the part that decides whether your newsletter lands in the inbox or the spam folder. Yellaro handles all of it for you: managed Listmonk hosting with sending and deliverability included. See how it works or read why it matters.

Common questions

What is an SPF record?
An SPF record is a single line in your domain's DNS that lists which mail servers are allowed to send email for you. When a receiving server gets a message from your domain, it checks the SPF record to confirm the sending server is on your list. If it is not, the message looks like a forgery.
What does ~all vs -all mean?
The all mechanism at the end of an SPF record sets the default for any server not listed. -all (hardfail) tells receivers to reject mail from unlisted servers, the strictest option. ~all (softfail) tells them to accept it but treat it as suspicious, the common safe default. ?all (neutral) expresses no opinion and offers little protection. +all allows any server to send for you, which defeats the purpose of SPF and should never be used.
Why does SPF have a 10-lookup limit?
Every include, a, mx, ptr, exists, and redirect mechanism in your SPF record triggers a DNS lookup, and the spec caps the total at 10 to stop receivers doing unbounded work. Go over 10 and SPF returns a permerror, which means it fails even when everything else is correct. If you chain many include statements, one per sending service, you can hit the limit without realizing it.
Is this checker free?
Yes, completely free and no signup. Check as many domains as you like.