SPF Record CheckerVerify your SPF TXT record is live across every independent DNS resolver
- 7 independent networks
- Records + DNS flags
- No ads, no sign-up
Independent networks
7 public DNS networks, queried in parallel
Every test query is answered by these unaffiliated resolvers on separate networks and infrastructure. When they agree, you can trust the result.
- 8.8.8.8
Google Public DNS
Google LLC · North America
- 1.1.1.1
Cloudflare
Cloudflare, Inc. · Global Anycast
- 94.140.14.14
AdGuard DNS
AdGuard Software Ltd. · Europe
- 45.90.28.0
NextDNS
NextDNS, Inc. · Global Anycast
- 185.222.222.222
DNS.SB
xTom / Layer0 · Europe
- 223.5.5.5
Alibaba DNS
Alibaba Cloud · Asia
- 119.29.29.29
DNSPod
Tencent Cloud · Asia
How it works
A test query for flag propagation check, done right
Most checkers query a single resolver or a set of geographically labelled servers behind the same anycast network. isPropagated queries genuinely independent DNS operators and compares both their records and their response flags.
Enter a domain and run the test query
Type any domain, pick a record type (A, AAAA, CNAME, MX, TXT, NS and more), then run a single test query that fans out to every network at once.
We query independent global networks
Instead of asking one resolver, we ask several unaffiliated public DNS networks in parallel — across North America, Europe and Asia — so no single cache can mislead you.
Compare records and DNS flags
Each network returns its answer plus the DNS response flags (AD, CD, RA, RD, TC). We check that both the records and the flags agree before calling a domain propagated.
Read the propagation verdict
A clear consensus score shows how many networks resolved the record and whether their answers match — so you know the moment a change is live everywhere.
What is an SPF record and why verify its propagation?
SPF (Sender Policy Framework) is a DNS-based email authentication standard. You publish a TXT record on your root domain — starting with "v=spf1" — that lists which mail servers are authorized to send email on your behalf. Receiving mail servers look up your SPF record before accepting a message, and reject or mark as spam messages from servers not listed in it.
SPF propagation matters because a new or updated SPF record is not honored by receiving mail servers until it has propagated worldwide. If you add a new sending service (e.g., Mailchimp, SendGrid, Google Workspace) but the SPF update has not reached all resolvers, messages sent through that service before propagation completes may fail SPF checks and land in spam.
A common SPF mistake is having two "v=spf1" TXT records on the same domain. The SPF specification allows only one; having duplicates causes a PermError, which most receivers treat as a hard fail. This checker shows all TXT records at your root domain so you can spot duplicates immediately.
How to use the SPF preset for quick checking
Click the "SPF" quick button below the domain input and enter your domain. The tool will automatically query TXT records on your root domain and compare them across all 7 resolvers. Look for a consistent "v=spf1 … ~all" or "-all" record across every network.
If any resolver still shows the old SPF record or no record at all, propagation is not yet complete. Wait for the TTL to expire on the old value, then re-check. Once every resolver returns the same SPF record, your email authentication is enforced globally.
FAQ
Common questions about spf record checker
How do I check my SPF record propagation?
Enter your domain in the input field above and click the SPF quick button, or select TXT from the dropdown and run the test. The results show the full TXT record set each resolver currently returns, including the SPF record.
How long does an SPF record take to propagate?
SPF is a TXT record and follows standard TTL rules. Most providers set a default TTL of 3600 seconds (1 hour). After you save the record, all resolvers should return the new value within one TTL cycle.
What is the SPF PermError and how do I fix it?
A PermError occurs when there are two or more "v=spf1" TXT records on the same domain, or when the SPF record has a syntax error. Fix it by ensuring there is exactly one SPF record and that it is syntactically correct. After fixing, wait for propagation and verify with this checker.
What is the difference between ~all and -all in SPF?
"~all" (SoftFail) tells receivers that mail from unlisted servers is likely unauthorized but should not be rejected outright. "-all" (HardFail) instructs receivers to reject mail from unlisted servers. Start with ~all and move to -all once you are confident all legitimate sending sources are listed in your SPF.
Does SPF prevent my domain from being spoofed?
SPF protects the "envelope from" address used during SMTP delivery but does not protect the visible "From:" header. For full protection against spoofing, combine SPF with DKIM (which signs the message headers) and DMARC (which specifies policy when SPF or DKIM fail). Check DKIM and DMARC propagation from the quick buttons below the domain input.