SPF Record Checker
Validate a domain's SPF record, expand every include and see how close it is to the 10-DNS-lookup limit.
Free, no account needed.
What this check looks at
- Whether exactly one SPF record (v=spf1) is published, and whether its syntax is valid.
- Every include:, a, mx, exists and redirect, expanded recursively, with the total number of DNS lookups.
- The 10-lookup limit: going over it makes SPF fail with a permanent error, even for legitimate mail.
- The ending: -all (fail), ~all (softfail), ?all (neutral) or the dangerous +all, which lets anyone pass.
Fixing "too many DNS lookups"
Each include counts, and includes inside includes count too. Remove services you no longer use, replace includes with the ip4:/ip6: ranges a provider publishes when they are stable, and move bulk senders to a subdomain with its own SPF record.
SPF and DMARC
SPF checks the envelope sender (Return-Path), not the From address people see. For DMARC, SPF only counts when that envelope domain matches your From domain. Many email services use their own Return-Path unless you set up a custom one, which is why DKIM is usually the more reliable way to pass DMARC.
Frequently asked questions
Can a domain have two SPF records?
No. Two v=spf1 records make SPF fail with a permanent error. Merge them into one record.
Should I use -all or ~all?
Use ~all while you are still finding all of your senders, then -all once you are confident. With DMARC at p=reject, the practical difference is small because DMARC decides what happens.
Do ip4 and ip6 mechanisms count toward the limit?
No. Only mechanisms that need a DNS lookup count: include, a, mx, ptr, exists and redirect.
Related tools
- DMARC CheckerLook up a domain's DMARC record and see exactly what it does: the policy, where reports go, and what to fix.
- DKIM Record CheckerLook up a DKIM public key and check its type, length and syntax. Don't know the selector? Leave it blank and we'll try the common ones.
- Email Domain Health CheckRun every email and DNS check for a domain at once and get a single report with everything that needs attention.
- MX Record LookupSee which mail servers receive email for a domain, in priority order, with their IP addresses and reverse DNS.