SPF record checker

Who is allowed to send email as this domain, and does the record stay inside SPF’s limit of 10 lookups?

Live lookupPlain English + technicalFree, no sign-upspf.middle.network

How to read the results

The gauge counts DNS lookups: over 10 and SPF fails for everyone.
The tree shows every include, so you can see which service uses the most.
The all mechanism at the end decides what happens to everyone else: -all rejects, ~all marks as suspicious.

Check everything at once

The health check runs this and 30 more checks on a domain, then ranks what to fix.

Guides for auditors

Compliance checks

Domain audit Domain security audit ISO 27001 domain compliance check SOC 2 domain security check Cyber security compliance check

More in Email authentication

DKIM checkFind DKIM keys and check their strength.
DMARC checkRead the DMARC policy and reporting setup.
BIMI checkCheck your brand logo record for inboxes.
MTA-STS checkCheck encryption is enforced for incoming mail.
TLS-RPT checkCheck you get reports when secure delivery fails.
DANE / TLSACheck TLSA records for your mail servers.
SPF / DMARC / DKIM / BIMI generatorsBuild SPF, DMARC, DKIM, BIMI and MTA-STS records.

About the SPF check

Check a domain’s SPF record, expand every include, count DNS lookups against the limit of 10 and find void lookups and syntax errors.

Every result comes in two styles: plain English for everyone, and the exact technical detail for engineers, with the raw JSON one click away.

Questions

Receivers return permerror and SPF counts as failed, which can send your mail to spam.

Use ~all while you check everything is listed, then -all. With DMARC in place, either works.