01
What SPF does
SPF lists the servers allowed to send email for your domain, so receiving servers can reject imposters.
Free security tool · no sign-up
SPF Record Checker.
Your SPF record tells the world which servers may send email for your domain. Check yours in seconds.
Free for AwareX client employees and anyone who needs a quick check. No sign-up required.
How to check, verify, and actTry an example:
DNS queried via Cloudflare. We don’t store your input.
Your workplace verification guide
Check it. Verify it. Know what to do next.
Review which services a domain authorizes to send email. Employees can check public records; only an authorized administrator should change them.
Prepare your input
Enter the domain you want to review, such as example.com, without a page path.
Run the check
Select Check records. The tool requests the public DNS records through Cloudflare.
Review the result
Review the SPF entries with your DNS or email administrator before making changes.
How to verify independently
Enter the domain after the @ in your work email.
Look for v=spf1 in the returned record.
Ask your email administrator to compare the include and IP entries with approved sending services.
Your next workplace action
Share the domain and returned SPF text with IT. Do not add senders, remove entries, or change the policy yourself.
What the result means
- Record found
- An SPF policy is published. This lookup does not validate every include, DNS lookup limit, or outgoing message.
- Multiple SPF policies
- Multiple v=spf1 policies at the same name can cause SPF errors. Ask IT to investigate.
- No record returned
- The policy may be missing, published at another name, or temporarily unavailable.
A returned record is not a security verdict. Missing records can reflect configuration, propagation, or a lookup issue.
Why it matters
Understand your records.
Strengthen your domain.
A data breach doesn't have to be the end of the story. Make your next move a secure one.
02
One record only
A domain should publish a single SPF record. Multiple SPF records can cause validation to fail.
03
Pair it with DMARC
SPF works best alongside DKIM and DMARC. Use our DMARC checker to complete the picture.
Email authentication · industry research
Small record.
Real-world gaps.
SPF is widely deployed, and still widely misconfigured. These figures come from published research and adoption reports across millions of domains, not from your lookup.
36.7%
Valid SPF is still the minority
Of the 10 million most popular domains on the internet, 36.7% publish a syntactically valid SPF record, 1.4% publish one with syntax errors or excessive lookups, and 61.9% publish no SPF record at all.
Fortra · State of Email Trust, Q2 202534.7%
Wide-open policies invite forgery
A study of 12 million domains found that 34.7% authorize email from more than 100,000 IP addresses. Loose policies like these make it easy for attackers to send mail that passes an SPF check while appearing to come from a legitimate domain.
ACM Internet Measurement Conference · 2023 SPF study7.7%
Published is not the same as protected
Across 1.8 million domains analyzed in 2025, only 7.7% of domains with a DMARC record both reject unauthenticated mail and collect daily authentication reports, leaving the rest open to spoofing.
EasyDMARC · 2025 DMARC Adoption ReportAfter the check
Records protect the domain.
People protect the inbox.
A healthy SPF setup closes one door. Attackers simply knock on another one: the person reading the message. That is where AwareX comes in.
- Your domain
SPF is in place
Correct records make it harder for attackers to send email that looks like it came from your exact domain.
- The attacker
They switch to people
Lookalike domains, personal accounts, SMS, calls, and deepfakes skip DNS checks entirely and land with an employee.
- AwareX
Your people get practice
AwareX AI rehearses those exact lures with your teams, so the human layer is tested as carefully as your records.
AwareX is AI-powered human risk testing: it learns your business, runs realistic simulations across email, SMS, voice, QR codes, and deepfakes, and adapts learning to how your people respond.
See AwareX in Action - Book a demoTHE PLATFORM BEHIND THE CHECKFive AI agents. One New Age
Five AI agents. One New Age
Human Risk Management platform.
This free tool shows one signal. AwareX is a New Age Human Risk Management platform: five AI agents work together to test your people the way attackers would, and to turn every response into learning.
Context engine
Learns your business from public context: departments, products, and tone, so every test is grounded in how your organization actually works.
Scenario engine
Drafts and scores attack scenarios against your scope, the way a real attacker would plan them.
Lure composer
Writes on-brand emails, messages, and calls with realistic signatures and sender identities, ready for your review.
Risk calibration
Compares predicted risk with how people actually respond, so the picture gets sharper after every wave.
Targeting and routing
Decides who needs practice next and routes learning to the people and teams that need it most.
Beyond the free check
See AwareX
in action.
A SPF Record Checker result is one piece of the picture. Explore how AwareX connects realistic simulations, learning, and reporting for your organization.
- Explore scenarios tailored to your business.
- See campaign activity and learning progress together.
- Discuss setup, training, and ongoing support.
What this free tool checks
Your SPF record tells the world which servers may send email for your domain. Check yours in seconds. This tool queries public DNS through Cloudflare and displays the SPF records returned for your domain. Use the results to review your configuration; finding a record does not by itself confirm that your domain is secure.
Where we test
- ContextualAn AI agent scans the web
- EmailSpoofed senders and fake invoices
- SMSDelivery alerts and code traps
- VoiceUrgent calls from trusted numbers
- QR CodeCodes on posters and payment slips
- DeepfakeCloned faces and voices on calls
AIDrafted by AI, approved by you
THE IMPROVE FRAMEWORKIMPROVE.
IMPROVE.
One continuous loop.
Identify, Measure, Prioritize, Reduce, Optimize, Validate, and Evaluate. AI connects business context, employee responses, and targeted learning to inform each next test.
WHY TEAMS PARTNER WITH AWAREX
The benefits of partnering with AwareX
A free check tells you where you stand today. A partnership with AwareX turns that snapshot into a continuous, AI-powered program.
Contextual by default
Simulations are written from your sector, your roles, and current events, so every test feels real to the person receiving it.
Learning in the moment
Every response informs the next test and the lesson that follows it, so training adapts as your risk changes.
Evidence you can present
Dashboards, records, and compliance alignment give leadership and auditors a clear picture of progress.
Support at every step
Setup, campaign planning, and ongoing optimization from a team that runs these programs every day.
Frequently asked questions
Good questions.
Straight answers.
Free access, safe follow-up, and answers specific to this checker.
Yes. Every AwareX free tool is free to use, and you can run as many checks as you need.
No. There is no account, no sign-up, and nothing to install. Open the page, run the check, and read the result.
Share the result with your DNS or email administrator, close any gaps they identify against your provider’s recommended setup, and re-run the check to confirm the change.
SPF lists the servers authorized to send mail for a domain. This checker displays the published policy; it does not perform a complete SPF validation or test an email message.
Publish only one v=spf1 record per domain. Multiple SPF records can cause a permanent authentication error. Combine authorized services into a single policy with your email provider’s guidance.
~all marks unlisted senders as a soft fail; -all marks them as a fail. The receiving mail server decides how to handle the message. Neither setting guarantees rejection.
No. SPF checks the envelope sender and can fail during forwarding. DKIM and DMARC add signing and alignment checks that help protect the domain people see in the From address.
THE NEXT ATTACK IS ALREADY BEING WRITTEN, BY AI