coldemailinboxes.io
TOOL: SPF CHECKER

Free SPF Checker

Look up a domain's Sender Policy Framework record and confirm it authorizes your sending infrastructure. One domain, or up to 100 in a list.

What this checker does

It queries the domain's TXT records live, finds the one beginning v=spf1, and parses it. You get the raw record, the mechanisms it authorizes, a count of the RFC 7208 ten-lookup budget it consumes, the final all mechanism, and an explicit yes or no on whether Microsoft 365 is authorized to send.

Nothing is cached. Every check is a fresh DNS query, so a record edited moments ago shows up as soon as the change has propagated.

Reading the result

DNS lookups is the number that breaks records silently. Each include expands into the mechanisms of the record it points at, and those count too. At eleven the record is invalid and receivers behave as though no SPF exists. Anything above about seven deserves attention before another vendor is added.

Microsoft 365 authorized looks for include:spf.protection.outlook.com, directly or through a nested include. If this reads No while you are sending from Microsoft 365, every message is failing SPF.

All mechanism shows how receivers should treat senders that are not listed. A record with no all at all is treated as neutral, which enforces nothing.

Failures that look fine

Two SPF records. Usually the result of adding a vendor's record instead of merging it into the existing one. The domain fails SPF outright rather than passing both.

Lookup budget quietly exceeded. A record that worked last year breaks when a vendor expands their own includes. Nothing on your side changed, which is what makes it hard to spot.

SPF passing, alignment failing. SPF authenticates the envelope sender, which is often the sending platform's own domain. DMARC requires that domain to align with the visible From address. SPF can pass while DMARC fails for this reason.

Checking the wrong domain. Cold email usually runs on a dedicated sending domain, not the primary one. Check the domain in the From address of the actual campaign.

How do I check SPF for many domains at once?

Switch to Bulk list and paste up to 100 domains, one per line, or load a text or CSV file and the first column is used. Every domain is looked up the same way as a single check and comes back as a row: verdict, how many of the ten DNS lookups the record spends, the all mechanism, and whether Microsoft 365 is authorized. Download the table as CSV to keep the audit with the campaign.

The limit is 100 domains per batch and three batches a minute, the same for a guest and a signed-in user. A batch of new sending domains before a campaign is the case it is built for.

Common questions

Yes. Switch to Bulk list, paste up to 100 domains one per line or load a CSV, and every row comes back with its verdict, lookup count, all mechanism and whether Microsoft 365 is authorised. Download the table as CSV. The same limit applies whether or not you are signed in.

Ten. RFC 7208 caps the mechanisms that trigger a DNS query - include, a, mx, ptr, exists and redirect - at ten in total, counted after every nested include is expanded. Exceed it and the record returns permerror, which most receivers treat as no SPF at all. The checker reports the count so a record can be trimmed before it breaks.

-all is a hard fail: only the listed senders are authorized. ~all is a soft fail, asking receivers to accept but mark unauthorized mail. ?all is neutral and enforces nothing. For cold email use ~all while you confirm every legitimate sender is listed, then move to -all once the record is settled.

No. A domain with two TXT records starting v=spf1 is a permerror, and the whole SPF evaluation fails. Merge them into a single record by combining their include mechanisms.

No. SPF authorizes sending hosts, but it breaks on forwarding and does nothing for the visible From address on its own. DKIM signs the message so it survives forwarding, and DMARC ties the two to the domain the recipient actually sees. Cold email needs all three.

Authentication is a prerequisite, not a ranking factor. Passing SPF, DKIM and DMARC gets a message evaluated on its merits; volume, list quality, engagement and content decide where it lands. A domain sending faster than its reputation supports will be filtered whether or not SPF passes.

Related