SPF record checker
Type a domain. We follow its SPF record through every include to the addresses at the end, count the lookups a receiver makes, and name the services the record allows to send as the domain. The same check looks for names that copy the domain, and says who holds each part.
Or see it done for a domain we watch
Digital Footprint
Lookalikes
What the check reads
An SPF record lists the servers that may send mail with your domain in the return path. Most records name a service with include:, and that service's record names more. A receiver follows the chain and stops after ten DNS lookups. Mail that needs a term past the tenth fails SPF, however correct the term is.
The end of the record says what to do with every other sender: -all refuses them, ~all marks them, and +all allows the whole internet. SPF alone does not protect the From address a person reads. DMARC does that, and it counts SPF only when the return path is under your domain.