SPF Record Checker - Validate SPF and Count DNS Lookups
Look up a domain's SPF record, expand every include, count DNS lookups against the 10-lookup limit, and get a plain-English list of what to fix.
SPF Record Syntax
An SPF record is a single TXT record at the root of the sending domain. It starts with v=spf1, lists the allowed senders, and ends with an all mechanism that says what to do with everyone else:
v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.10 ~all
| Mechanism | What it matches | DNS lookup |
|---|---|---|
| ip4 / ip6 | An IP address or CIDR range, e.g. ip4:203.0.113.0/24 | No |
| include | Every sender authorized by another domain's SPF record | Yes |
| a | The IPs in the domain's A/AAAA records | Yes |
| mx | The IPs of the domain's MX servers | Yes |
| exists | Passes if a constructed hostname resolves | Yes |
| ptr | Reverse DNS match (deprecated, avoid) | Yes |
| redirect= | Use another domain's SPF policy instead | Yes |
| all | Everything else. Prefix with - ~ ? or + | No |
How to Fix Common SPF Errors
- PermError: too many DNS lookups. Remove includes for services you no longer use, drop
aandmxif those servers don't send mail, and replace includes for static infrastructure withip4/ip6. - Multiple SPF records. Often caused by adding a new provider as a second TXT record. Merge them into one.
- No SPF record. Use the SPF record generator to build one for your providers.
- +all or ?all. These authorize everyone or assert nothing. Switch to
~allor-all. - Include points to a domain with no SPF. Usually a typo or a retired provider. Each one is a void lookup, and more than two cause PermError.
SPF is only one of three checks. Pair it with DKIM and a DMARC policy. Check them with the DMARC checker and DKIM checker.
SPF Record FAQ
What is an SPF record?
SPF (Sender Policy Framework, RFC 7208) is a DNS TXT record that lists the servers allowed to send email for a domain. Receiving servers compare the connecting IP with that list and return Pass, Fail, SoftFail or Neutral. The result feeds into DMARC and spam filtering.
What does "too many DNS lookups" mean?
SPF evaluation may trigger at most 10 DNS lookups. The include, a, mx, ptr and exists mechanisms and the redirect modifier each count as one, including those inside nested includes. Above 10, receivers return PermError and SPF fails. Remove services you no longer use or replace includes with ip4/ip6 ranges.
Should I use ~all or -all?
Both are fine once every legitimate sender is in the record. ~all (SoftFail) asks receivers to accept but mark mail from other servers. -all (Fail) asks them to reject it. With a DMARC policy in place most receivers act on DMARC rather than the SPF qualifier, so ~all is the common choice. Never use +all.
Can a domain have more than one SPF record?
No. A domain must publish exactly one TXT record that starts with v=spf1. With two or more, receivers return PermError. Merge all mechanisms into a single record.
Does SPF apply to subdomains?
No. SPF is checked against the exact domain in the envelope sender (Return-Path). A subdomain like mail.example.com needs its own SPF record if it sends email.
Why does SPF pass but DMARC still fail?
DMARC needs SPF to pass for a domain that aligns with the visible From address. Many email services use their own Return-Path domain, so SPF passes for their domain, not yours. Configure a custom Return-Path (bounce) domain with the provider, or rely on DKIM alignment.
More Free Email Tools
MX Lookup
Find the mail servers for a domain, their priority, IPs and email provider
SPF Record Generator
Build a valid SPF record for Google Workspace, Microsoft 365, SES and more
DMARC Record Checker
Look up and explain a domain's DMARC policy, reporting and alignment
DMARC Record Generator
Create a DMARC TXT record with policy, reports and alignment settings
DKIM Record Checker
Check a DKIM selector, read the public key and its length, or scan common selectors
SMTP Test Tool
Open a live SMTP session, test TLS and authentication, and send a test email