SPF Record Checker

Send domains, get each one's SPF record parsed into its mechanisms and includes, with the DNS lookup count and the issues found.

You give it	You get back	You pay (Free plan)
One domain or a list of up to 50	Per domain: has SPF, raw record, parsed mechanisms, DNS lookup count, the all qualifier, issues	$0.0008 per domain

Pay per result only: no subscription, no start fee. An invalid domain or DNS error returns {ok:false, error} and is not charged. Paid Apify plans get Store discounts on the price above.

Try it in one click

The input form is already filled in with this example. Press Start and you get the output below.

{
  "domain": "google.com",
  "domains": [
    "github.com",
    "microsoft.com"
  ]
}

Real output from that exact input (run on 2026-09-24; long arrays shortened to a few entries and long text cut for display):

[
  {
    "domain": "github.com",
    "ok": true,
    "hasSpf": true,
    "record": "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.c…",
    "mechanisms": [
      {
        "qualifier": "+",
        "type": "ip4",
        "value": "192.30.252.0/22",
        "lookup": false
      },
      {
        "qualifier": "+",
        "type": "include",
        "value": "spf.protection.outlook.com",
        "lookup": true
      }
    ],
    "lookupCount": 8,
    "allQualifier": "~",
    "issues": []
  }
]

Validate any domain's SPF record and catch the failure everyone misses: the 10-DNS-lookup limit. Check one domain or up to 200 per run, online, by API, or as an agent tool via Apify MCP.

This actor fetches the v=spf1 TXT record, parses every mechanism, counts DNS lookups against RFC 7208's hard limit of 10 (exceed it and receivers return PermError — your SPF silently stops working), and flags permissive or missing all qualifiers. Useful for deliverability audits, cold-email domain setup, security reviews, and lead generation (find domains with broken SPF).

What you get

• hasSpf — is a v=spf1 record published?
• record — the raw SPF string
• mechanisms — every term parsed: qualifier (+/-/~/?), type (ip4, include, mx, …), value, and whether it costs a DNS lookup
• lookupCount — total DNS lookups vs the RFC 7208 limit of 10
• allQualifier — how unmatched senders are treated (-all fail, ~all softfail, ?all neutral, +all open)
• issues — plain-English flags: no record, multiple records (an RFC error), over the lookup limit, +all/?all, missing all
• Fail-soft: an invalid domain or a DNS error never fails the run — it returns {ok: false, error} and is never charged.

Input

{ "domains": ["github.com", "microsoft.com"], "maxDomains": 50 }

Or a single domain: { "domain": "google.com" }

Output (real run)

{
  "domain": "github.com",
  "ok": true,
  "hasSpf": true,
  "record": "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com ... ~all",
  "mechanisms": [
    { "qualifier": "+", "type": "ip4", "value": "192.30.252.0/22", "lookup": false },
    { "qualifier": "+", "type": "include", "value": "spf.protection.outlook.com", "lookup": true }
  ],
  "lookupCount": 8,
  "allQualifier": "~",
  "issues": []
}

Pricing

$0.0008 per domain checked. No start fee. Invalid domains and DNS failures are never charged.

Measured against store incumbents (2026-08-07): andok/dmarc-spf-dkim-validator charges $0.001 per item, blackfalcondata/email-deliverability-checker $0.00005 start + $0.001 per item, davidbenittah/dmarc-rfc9989-auditor $0.005 start + $0.005 per item. A 100-domain sweep here costs $0.08.

Honest limits

• Lookup counting is static: it counts lookup-type mechanisms in the top-level record (include, a, mx, ptr, exists, redirect). It does not recursively resolve nested includes, so a record that nests its way over the limit can pass here — the top-level count is what most audits need first.
• DNS-only: no test emails are sent; this validates the published record, not your mail server's behavior.
• One record per domain: when multiple SPF records exist (an RFC violation, flagged in issues), the first is parsed.

FAQ

Why does the 10-lookup limit matter? RFC 7208 caps SPF evaluation at 10 DNS lookups. Past that, receivers return PermError and your SPF effectively fails — a very common silent misconfiguration after adding several SaaS senders.

What's the difference between ~all and -all? -all tells receivers to fail unmatched senders outright; ~all marks them suspicious (softfail). ?all and especially +all provide no real protection and are flagged.

Does it check DKIM or DMARC too? No — this is a focused SPF tool. Pair it with our DMARC Record Checker and MX Record Checker for the full email-auth picture.

Can I paste full URLs? Yes. https://www.example.com/path is cleaned to example.com automatically; duplicates are removed.

Why did some rows come back ok: false? Those inputs were not valid domains or their DNS lookup failed transiently. They are recorded for completeness and never charged.

Use from code or AI agents

curl -s "https://api.apify.com/v2/acts/EliAI~spf-record-checker/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -X POST -H 'Content-Type: application/json' \
  -d '{"domains": ["yourdomain.com", "competitor.com"]}'

Agents: connect Apify MCP and call the EliAI/spf-record-checker tool.

• Capability: fetch, parse and lint the SPF record of one or many domains, returned as JSON
• Required input: domain (string) or domains (array)
• Returns: one JSON record per domain; lookupCount + issues summarize the verdict
• Bounded: maxDomains caps the run; failures isolate per domain
• Side effects: none

Who uses it

• Deliverability engineers finding domains that exceed 10 SPF lookups after adding one more email tool
• IT admins validating SPF after adding a CRM or helpdesk sender
• Cold-email operators checking each sending domain's SPF before a campaign
• Security auditors flagging +all and ?all records across a domain portfolio
• Agencies prospecting companies whose SPF currently returns a PermError

Changelog

• 2026-09-24: New summary at the top of this page: what you send, what you get, the price, and a real output from the prefilled example.