Home / SPF Checker
SPF Record Checker
Validate a domain's SPF record, count its DNS lookups against the limit of 10, and follow every include.
About SPF Checker
An SPF checker reads a domain's Sender Policy Framework record, the TXT record that lists which servers may send email for the domain. It follows every include and redirect, counts the DNS lookups that the record triggers against the limit of 10 set by RFC 7208, and explains the result receivers will reach for mail from unlisted servers. Use it after adding a new email service, when mail starts landing in spam, or before moving DMARC to an enforcing policy.
What this SPF checker tests
- That exactly one record starting with v=spf1 exists. Two records are a permanent error.
- The DNS lookup count across all nested includes, against the limit of 10 in RFC 7208.
- Void lookups, includes that return nothing. RFC 7208 says implementations should stop after two.
- The all mechanism at the end: -all (fail), ~all (softfail), ?all (neutral) or the dangerous +all.
- The ptr mechanism, which RFC 7208 says should not be published.
SPF qualifiers
| Qualifier | Result | Meaning |
|---|---|---|
| + (or none) | pass | The server is authorized |
| - | fail | The server is not authorized |
| ~ | softfail | Probably not authorized |
| ? | neutral | No statement either way |
How to fix too many SPF lookups
Remove includes for services you no longer use first. Replace an include with the ip4 and ip6 ranges it stands for only when the service publishes fixed ranges, because ip4 and ip6 do not count towards the limit. Sending marketing mail from a subdomain with its own SPF record also keeps the main record short.
Sources: RFC 9989 (DMARC), RFC 7208 (SPF), RFC 6376 (DKIM), RFC 8461 (MTA-STS), Google email sender guidelines.
Frequently asked questions
How do I check my SPF record?
Enter your domain above. The checker reads the TXT record that starts with v=spf1, follows every include and redirect, counts the DNS lookups, and warns about the mistakes that break SPF: two records, more than 10 lookups, a +all that lets anyone send, or a deprecated ptr mechanism.
What is the SPF 10 lookup limit?
RFC 7208 allows at most 10 mechanisms and modifiers that need DNS queries (include, a, mx, ptr, exists and redirect) per check, counted across every nested include. Going over makes SPF return a permanent error, which receivers treat as a failure. ip4, ip6 and all do not count.
What is the difference between ~all and -all?
-all is a fail: mail from servers not listed is not authorized. ~all is a softfail, a weaker statement that such mail is probably not authorized. Both are valid; with DMARC at quarantine or reject, ~all is common because DMARC makes the final decision. Never use +all, which authorizes every server on the internet.
Can I have two SPF records?
No. If a domain publishes more than one record starting with v=spf1, the result is a permanent error under RFC 7208. Merge them into one record with all the includes you need.