SPF Record Checker
This free SPF checker validates a domain's SPF record, counts its DNS lookups against the limit of 10, and shows every include so you can see what breaks.
What is an SPF record?
An SPF record is a TXT record listing the servers allowed to send email for your domain. Receiving servers check it to spot forged senders.
It starts with v=spf1, lists senders with mechanisms like ip4, include and mx, and ends with an all rule saying what to do with everyone else.
Why the 10-lookup limit matters
SPF allows at most 10 DNS lookups per check, counting every include, a, mx, ptr, exists and redirect, including the ones nested inside other providers' records.
Go over 10 and receivers treat your SPF as broken (PermError), which can push legitimate mail to spam. Every new email tool you add tends to add an include, so it creeps up quietly.
Frequently asked questions
Should I use -all or ~all?
~all (soft fail) is the safe default while you're still finding every service that sends for you. Move to -all once you're sure the list is complete and DMARC is in place.
Can I have two SPF records?
No. Two v=spf1 records on the same domain is an error and receivers ignore both. Merge them into one record.
How do I get under 10 lookups?
Remove includes for services you no longer use, replace includes with the provider's ip4/ip6 ranges where they're stable, and move bulk-mail services to their own subdomain.
Does SPF alone stop spoofing?
No. SPF checks the hidden envelope sender, not the From address people see. You need DMARC on top to protect the visible From.