SPF Checker
Validate SPF records and spot common mistakes.
Results appear here. Enter a domain name, then select Check SPF.
Domain Health Report
This page checks one thing. The report checks thirteen — and tells you what to fix first.
A one-off €14.90 report, delivered by email in minutes. Every finding comes with a concrete fix, prioritized.
- DNS records (A/AAAA)
- Nameservers (NS)
- Mail servers (MX)
- SPF record and policy
- DMARC record and policy
- DKIM record (common selectors)
- HTTPS availability
- HTTP to HTTPS redirect
- TLS certificate (issuer, validity, expiry)
- Security headers (HSTS, CSP…)
- CAA records
- robots.txt availability
- sitemap.xml availability
How the SPF check works
- Enter a bare domain name, such as example.com, and submit the form.
- The FKINFAST server queries the domain's TXT records through a public resolver and evaluates the SPF policy it finds.
- The result shows the record, the policy it ends with and a PASS, WARNING, FAIL or UNKNOWN classification with a plain explanation.
The check runs from FKINFAST's server, not from your browser. The domain you enter is not stored and the result is not linked to you.
Result states
- PASS
- Exactly one SPF record exists and it ends with -all (hardfail), the strictest policy.
- WARNING
- The policy is weak or ambiguous: it ends with ~all (softfail) or ?all (neutral), is delegated via redirect=, is malformed, or several SPF records exist at once.
- FAIL
- No SPF record was found, or it ends with +all, which authorizes anyone to send as this domain.
- UNKNOWN
- The lookup could not be completed: it timed out or the public resolver failed.
Page-level errors are separate from these results. A validation error, rate limit, busy response, unavailable service or network failure is shown as an error, not as a FAIL result.
How the record is evaluated
- Only the terminal policy of the SPF record is evaluated — the same check the report engine uses.
- ~all (softfail) is the industry-standard ending and is valid, but it only marks unauthorized mail instead of rejecting it.
- -all (hardfail) is the strictest policy and the only ending that scores a PASS.
- ?all takes no position, +all authorizes everyone, and a record with none of these (and no redirect=) is treated as an error by receivers.
- Multiple SPF records are worse than one: receivers may ignore all of them.
- Limited to 15 checks per 60 seconds per client IP (shared with the DMARC checker).
What the check does not do
The check evaluates the published SPF record only. It does not expand include: chains against the 10-lookup limit, does not verify that every legitimate sender is listed, and does not send or receive any email.
SPF checker FAQ
Is ~all a problem?
No — ~all is a common and valid ending (Cloudflare, Google and many providers recommend it). It marks unauthorized mail as suspicious but does not reject it. Switch to -all once you are confident every legitimate sender is listed.
Why are multiple SPF records a problem?
The SPF specification allows exactly one record per domain. With several, receivers may return a permanent error and ignore all of them — remove the extras at your DNS provider.
Why does +all fail?
+all means "any server may send as this domain": spammers can then send mail that passes SPF, which weakens DMARC and lands you in spam filters. It is never correct in production.
I just changed the record — why is the old one still shown?
DNS changes take time to spread, and the check may briefly serve a cached answer. If your provider shows the new record elsewhere, wait a few minutes and retry.