Enter your domain: in 8 seconds you'll know whether your list of authorised senders is complete, valid, and within the limits — in plain English, no jargon.
SPF is the list, published in your DNS, of the servers allowed to send email with your domain name: your mailbox provider (Google Workspace, Microsoft 365…), but also your newsletter tool, your invoicing software, your CRM. When an email arrives, the recipient's mailbox provider checks whether the sending server is on the list.
A service that sends in your name without being on the list isn't "sort of" declared: to Gmail or Outlook it looks like an impostor. It's the number-one reason quotes end up in spam.
Every include: in your SPF forces the mailbox provider to fetch another record, which may in turn call others. Past 10 lookups in total, the rule says your SPF is invalid — and nothing gets checked any more, not even the services you declared correctly.
It's the classic trap: you add one tool, then another, and one day the eleventh silently breaks everything. The scan counts the lookups for you.
Your SPF ends with an instruction for senders that aren't on the list. -all: refuse them. ~all: let them through but flag them as suspicious. +all or ?all: accept everyone — which amounts to having no SPF at all.
With DMARC in place, ~all is acceptable; without DMARC, -all is the only ending that really protects your name.
Whether an SPF record exists (and only one: two records cancel each other out), the final instruction, the number of lookups, and the sending services detected on your domain. It also checks DKIM and DMARC, which complete SPF, and gives you a score out of 100 with a plain list of what's wrong.
What it can't see: a tool you use that doesn't appear anywhere in your DNS. That's what DMARC reports are for — and the DMARC checker.
SPF is necessary, not sufficient. You also need a DKIM signature, a DMARC record, and a decent sender reputation. Often a forgotten service sends outside the list, or the SPF exceeds 10 lookups and isn't read at all.
List everything that sends email with your domain: mailbox provider, newsletters, invoicing, booking, your website. Each service documents the include: value to add. The scan detects the most common ones; DMARC reports reveal the rest.
No. Two records starting with v=spf1 make your SPF invalid. Merge every include: value into a single TXT record.
Remove services you no longer use, replace the include: of rarely-used services with their IP addresses when they publish them, and avoid nested includes. If you send through many tools, have them send from a subdomain.
Yes: no signup, no credit card, as many times as you like. Only daily monitoring with a weekly bulletin is paid.
The scan is free and needs no signup; if you want your domain watched every day with a weekly bulletin, monitoring starts at €25/month + tax — see pricing.