What is SPF? Guest list + free SPF checker
SPF is a guest list on your domain’s front door for email: only listed servers get to send mail that looks like it came from you. A free SPF checker confirms v=spf1 is still published, under the RFC 10-lookup limit, and not stuck on +all before you add another ESP.
What is SPF?
SPF (Sender Policy Framework) is a DNS TXT record that publishes which hosts are allowed to send mail for your domain. Receivers look up v=spf1 at the apex, expand include: and redirect= mechanisms, and decide whether the connecting IP was authorized. It is the “who may speak as us” half of email authentication—DKIM seals the message; DMARC decides what to do when either check fails.
The DNS record (v=spf1)
Publish one apex TXT that starts with v=spf1, lists your real senders (include:_spf.google.com, include:spf.protection.outlook.com, ESP includes, and so on), and ends with ~all or -all—not +all. Do not publish two competing SPF rows; receivers only honor one. Nested includes still count toward the RFC 7208 limit of 10 DNS lookups.
How to check SPF (free SPF checker)
1) Run the free SPF checker on the bare domain. 2) Confirm a single v=spf1 TXT at the apex—not a random TXT elsewhere. 3) Read the include tree and the lookup count (must stay ≤ 10). 4) Confirm the ending is ~all or -all, not +all. 5) If you just added an ESP, drop or flatten an unused include before publishing. 6) After any zone edit, re-check; apex TXT rows are easy to wipe or duplicate in panel rebuilds.
What CrowWake checks
We look up the apex TXT for a line that starts with v=spf1. We expand nested include: and redirect= terms, count RFC 7208 DNS lookups (include, a, mx, ptr, exists, redirect — limit 10), and warn if there are multiple SPF records, if the policy ends with +all (anyone can send), or if there is no clear ~all / -all ending. The free SPF checker shows the include tree with no login. CrowWake does not send a live SMTP test in v1—just whether the guest list is still published and sane. For the repeat “watch this hourly” job, see the dedicated SPF monitoring guide.
SPF vs SPF monitoring
This guide is the definition and publish/triage job: what SPF is, how v=spf1 + includes + the 10-lookup limit work, and how to check SPF with a free SPF checker. SPF monitoring is the hourly rooster—catch a wiped guest list, a forever-+all, or a new include that tips you over 10. Both use the same free checker; CrowWake just repeats the pulse.
Why it matters
Receivers (Gmail, Microsoft, and others) use SPF to decide whether a message claiming to be from you was sent from an allowed host. Bad or missing SPF is a common reason mail lands in spam—or gets rejected—especially after you add a new ESP, CRM, or marketing tool. Agencies lose apex TXT during rebuilds and only notice when campaigns bounce or DMARC alignment falls apart.
The 10 DNS-lookup limit
Each include, a, mx, ptr, exists, and redirect in the record — and inside nested includes — counts toward 10 lookups. Go over and receivers return permerror (SPF fails closed, even if the IPs look right). That is why “just add another ESP include” breaks mail. Flatten or drop unused includes before you add the next tool. The free SPF checker counts the tree so you see the number before you publish.
What “good enough” looks like
One SPF TXT record. It includes your real senders (Google Workspace, Microsoft 365, Mailchimp, transactional providers, and so on). It ends with ~all or -all—not +all. Keep the DNS lookup count under SPF’s limit after nested expansion. When you add a tool, drop or flatten an unused include first.
Publish checklist (order matters)
1) Inventory every platform that sends as you. 2) Publish one apex v=spf1 with those includes and ~all (or -all when ready). 3) Run the free SPF checker and confirm lookups ≤ 10. 4) Confirm DKIM selectors for those ESPs (free DKIM checker). 5) Keep or tighten DMARC (free DMARC checker). 6) Add the domain so CrowWake crows if the record disappears, duplicates, or tips over 10.
If CrowWake crows
Missing SPF → publish one provider-shaped TXT. Multiple SPF → merge into a single record. +all → tighten the ending. Over 10 DNS lookups → remove unused includes or flatten; do not add another ESP until the count is under 10. After DNS changes, give caches a few minutes, then re-run the free SPF checker and confirm CrowWake goes green.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.
Or try the free SPF / SPF checker checker with no login.
Deep dive: SPF monitoring — watch v=spf1 so a silent wipe, +all, or over-10-lookup tree crows early, with the same free SPF checker.
The free SPF checker lists the live include tree and lookup count. Pair with email authentication monitoring, what is email authentication, DKIM monitoring, and DMARC monitoring.