Record presence
Whether a public SPF record is available.
Free email security tool
Free SPF Record Checker and Analyzer
Validate your SPF record, resolve the full include and redirect chain, and see how close the policy is to the 10-DNS-lookup limit that causes SPF to fail.
CloudSpex explains what the detected SPF result means and what should be changed next.
What is an SPF record?
SPF is a DNS-based email policy that identifies permitted sending infrastructure for a domain. It is one email authentication signal and should be reviewed alongside DKIM and DMARC. Whether you call it an SPF lookup, an SPF test or an SPF check, the job here is the same: fetch the record and find out what it actually authorises once every include is resolved.
What does this SPF analyzer check?
Multiple records
Publishing more than one SPF record is a permanent error and makes evaluation fail.
DNS lookup count
How many of the 10 permitted DNS lookups the record consumes once every include and redirect is resolved.
Include and redirect chain
The full dependency tree, resolved recursively, including circular references.
Void lookups
Includes that return no usable SPF record. More than two is a permanent error under RFC 7208.
Duplicate includes
The same provider pulled in through more than one path, spending DNS lookups for nothing.
Terminal policy
Whether the record ends in +all, ?all, ~all or -all, and what that means for spoofing.
The analyzer resolves includes and redirects recursively rather than reading the record in isolation, because the failure that actually breaks SPF — exceeding ten DNS lookups — is invisible from the record text alone. Macro expansion and SPF flattening are not evaluated.
SPF checker vs email security check
SPF Record Checker
Focuses on one SPF record, multiple-record risk and its terminal policy when safely available.
Email Security Check
Reviews SPF, DKIM and DMARC together as a broader email-security summary.
Why restrictive SPF policies matter
A restrictive -all policy is often the intended end state after all legitimate senders are identified. Softfail and neutral policies can be useful transitional states, but +all does not restrict senders.
Frequently asked questions
What is an SPF record?
An SPF record is a public DNS record that identifies which mail servers may send email for a domain. Receiving servers can use it as one signal when evaluating whether a message is authorized.
What does the CloudSpex SPF checker test?
It checks whether an SPF record is present, whether more than one record is published, how many of the ten permitted DNS lookups the record consumes once includes and redirects are resolved, whether any include returns no usable record (a void lookup), whether the same provider is included more than once, and which terminal all policy is used.
What does +all mean in an SPF record?
+all allows any sender to pass SPF. It is generally a high-risk policy because it does not restrict which mail servers may send for the domain.
What is the difference between ?all, ~all and -all?
?all is neutral, ~all is softfail, and -all is a restrictive fail policy. Review legitimate senders before changing an SPF policy.
Can a domain have more than one SPF record?
No. Publishing more than one SPF record for the same domain makes SPF evaluation invalid. Combine authorized senders into one record instead.
What happens if a domain has no SPF record?
Receiving servers have no SPF policy for the domain to evaluate. Create a single SPF record after identifying every legitimate sender.
Does CloudSpex test the 10-DNS-lookup limit?
Yes. The checker resolves the include and redirect chain and reports how many DNS lookups the record consumes against the limit of ten. Exceeding it makes SPF fail with a permanent error, and that failure cannot be seen by reading the record text alone.
Is this the same as an SPF lookup or an SPF test?
Yes — the names describe the same job. A plain SPF lookup only fetches the TXT record; this test also resolves every include and redirect the record references, counts the DNS lookups against the limit of ten, and reports duplicate mechanisms, void lookups and the terminal all policy, so you see how the record behaves rather than just what it says.
Does the checker make changes to DNS?
No. CloudSpex reads public-facing signals only. It does not change DNS records, email configuration or domain settings.
SPF policies can change without warning.
Add your domain to CloudSpex to monitor SPF, DKIM, DMARC and related email-security configuration changes.
Start Monitoring FreeCheck Another Domain