SPF Checker

Check an SPF record

Validate the SPF record for any domain: syntax, the 10-lookup limit across every nested include, void lookups, and whether it ends in a policy that protects anything.

Guide

What the SPF checker tests

SPF (RFC 7208) lists the servers allowed to send mail for a domain. The checker reads the TXT record, follows every include and redirect the way a receiving server would, and reports:

  • One record, valid syntax. Two v=spf1 records, an unknown mechanism, or a malformed address is a permanent error: SPF fails for every message.
  • The 10-lookup limit. include, a, mx, ptr, exists and redirect each cost a DNS lookup, counted across the whole tree.
  • Void lookups. More than two names that resolve to nothing is also a permanent error, and usually means an include for a service you no longer use.
  • The final policy. -all and ~all protect the domain; ?all, +all or no all do not.
  • Deprecated and risky terms: ptr, terms after all, very wide IP ranges, and the retired SPF record type.

Everything runs in your browser over DNS over HTTPS. Macros and exists depend on the sending IP, so they are flagged rather than evaluated.

FAQ

SPF: common questions

What is an SPF record?

An SPF record is a DNS TXT record, starting with v=spf1, that lists the mail servers allowed to send email for a domain. Receiving servers compare the IP address of the connecting server against it, and use the result in spam filtering and DMARC.

Why does SPF have a limit of 10 DNS lookups?

To stop a single SPF check from turning into a flood of DNS queries. RFC 7208 caps evaluation at 10 lookups, counting include, a, mx, ptr, exists and redirect across every nested record. Over the limit, the result is a permanent error and SPF fails for all mail, legitimate or not.

Should my SPF record end in -all or ~all?

Either protects the domain once a DMARC policy is enforcing. -all (fail) is the strictest statement; ~all (soft fail) is a common choice while you are confident but not certain every sender is listed. Never use +all, which authorises every server on the internet.

Can a domain have two SPF records?

No. A domain must publish exactly one TXT record starting with v=spf1. With two, receivers return a permanent error. To add a sender, add it to the existing record.

Guides

Learn more

  • How to create an SPF record Build a correct SPF record step by step: find every service that sends as you, add the right includes, pick between -all and ~all, and avoid the common mistakes.
  • Fixing "SPF PermError: too many DNS lookups" Why SPF stops at 10 DNS lookups, how the count is worked out across nested includes, and four ways to bring a record back under the limit.