Skip to content
Check a domain

SPF checker · first check free

SPF checker: does your SPF record cover every service that sends your email?

Check the SPF record on a domain you own: whether it's valid, what it allows, and how it ends. Part of a full website security check, with DMARC and DKIM in the same report.

First check free with an account: low-risk findings in full, serious ones unlock with a one-time payment.

  • No card for the free check
  • Results usually in minutes
  • $8 for 1 check, $18 for 5, $59 for 20 (+ applicable tax)
  • No subscription needed
  • View sample report

Quick Scan

Areas checked
11
In good shape
4
Fixes in minutes
3 of 5
  1. Medium

    Protect the session cookie

    F2 · Confirmed · Minutes

    Evidence

    Observed
    Set-Cookie: PHPSESSID=…; path=/
    Expected
    Set-Cookie: PHPSESSID=…; path=/; Secure; HttpOnly; SameSite=Lax

    Fix

    1. Add the Secure and HttpOnly flags (and SameSite=Lax) to session cookies.
    2. In PHP: session.cookie_secure = 1 and session.cookie_httponly = 1.
  2. Low

    Add a DMARC record for your domain

    F3 · Confirmed · Minutes

    Evidence

    Observed
    _dmarc.example.com TXT (no record)
    Expected
    _dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

    Fix

    1. Make sure every service that sends your mail passes SPF or DKIM aligned with your domain, and confirm DKIM with your email provider.
    2. Publish a _dmarc TXT record: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com. p=none only monitors.
    3. When the reports show your real mail passes, move to p=quarantine.
  3. Medium

    Update an outdated component

    F1 · Likely · Hours

+ 3 more findings in the full report Open the sample report

What you get

A report you can act on.In plain English, with evidence.

SPF lists the servers allowed to send email for your domain. We read your published SPF record, check it's valid and ends with a clear rule for unknown senders, and show it next to your DMARC and DKIM records so you can see the whole picture.

  • Your first check is free: create an account and confirm your email.
  • Your SPF record, read from public DNS, with what each part means
  • A clear verdict on how it treats senders it doesn't list
  • For domains you own; DMARC, DKIM and the rest of your website are checked too

Pricing

From $8 a check.Buy more, pay less per check.

Plus applicable tax, shown before you pay. No subscription needed.

See pricing and the calculator

Quick Scan

Available

5 checks cover a month of weekly checks for $18. No subscription needed.

  • One credit checks one website
  • Credits last 12 months
  • One-off payment, no auto-renewal
  • Credit back automatically if your scan can't run or half or fewer of its checks run. If your website blocks us but most checks ran, the website checks re-run free, once, within 30 days. How credits work
Check my SPF

Checkout by Stripe. We never see your card.

Prices before tax. Final total shown before you pay.

Powered by Stripe

Apple Pay Google Pay · Link · Visa · Mastercard · American Express

Where available for your device and country.

What we check

Everything we read for your email.SPF, and the records that work with it.

Part of every Quick Scan, alongside the other checks.

  • SPF record

    Present, valid, and ending with a clear rule for unknown senders.

  • DMARC policy

    Published, readable, enforcing, and covering your subdomains too.

  • DMARC reports

    A reporting address is set, and authorised when it is on another domain.

  • DKIM signing keys

    The keys we can find, and whether they're long enough.

  • Mail servers (MX)

    Each one exists, is a proper name, and the records agree.

  • Domains that send no email

    Locked down so nobody can send as them.

  • MTA-STS and TLS-RPT

    Incoming mail kept encrypted in transit, with reports switched on.

  • BIMI

    Your brand logo record, when you publish one.

Real format

Two findings.Exactly as a report shows them.

Open the full sample report

F3 · dns-email-auth

Add a DMARC record for your domain

Low Confirmed Minutes

What it means
A DMARC record tells receiving mail servers what to do with email that claims to come from your domain, so they can turn away mail that only pretends to be you. We look for DKIM keys under common names only and found none, so we couldn't confirm DKIM.
Evidence
_dmarc.example.com  TXT  (no record)
Expected
_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"
Fix
Make sure every service that sends your mail passes SPF or DKIM aligned with your domain, and confirm DKIM with your email provider. Publish a _dmarc TXT record: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com. p=none only monitors. When the reports show your real mail passes, move to p=quarantine.

F1 · technology-fingerprint

Update an outdated component

Medium Likely Hours

What it means
Your site announces PHP 7.4.3. PHP 7.4 stopped getting security fixes on 28 November 2022, so new problems in it won't be fixed.
Evidence
X-Powered-By: PHP/7.4.3
PHP 7.4 — end of life 2022-11-28
Expected
A supported PHP 8 release (8.3 or later), version not announced (expose_php = Off)
Fix
Ask your host which PHP version really runs: the version a site announces can differ. Then move the site to a supported PHP version (8.x) and test it, as older code may need changes. Then stop announcing the version: set expose_php = Off.

Questions

Short answers.

Something else? support@scandefend.com

Is this a free SPF lookup?

It's part of a full website security check, from $8 a check with no subscription.

My SPF record exists. Am I protected?

SPF on its own doesn't tell receiving servers what to do with mail that fails. That's DMARC's job, so the report checks both and says what to add.

Do you need access to my DNS account?

No. We read your public DNS records, the same ones any mail server sees. You make the changes with whoever manages your domain.

Keep exploring

Also useful: What we check Free instant SPF lookup

See what your website shows.Know what to fix first.

First check free with an account: low-risk findings in full, serious ones unlock with a one-time payment.

See pricing