SPF record checker
Look up a domain's SPF record, validate its syntax, and count the DNS lookups it costs — including every nested include — against the limit of ten.
What this catches
Every problem below is one this tool detects and explains, with the record to publish.
An SPF include could not be resolved
A referenced record did not return an answer when we checked.
Legacy SPF-type record found
A record of the obsolete SPF DNS type exists alongside the TXT record.
More than one SPF record published
Two or more SPF records exist. Receivers treat this as a permanent error and SPF fails outright.
No SPF record found
This domain publishes no SPF record, so receivers have no list of authorised senders.
SPF record contains a syntax error
Part of the record is not valid SPF, so receivers may reject the whole record.
SPF record contains lookups that resolve to nothing
One or more includes point at names that no longer exist.
SPF record ends with ?all
The record explicitly takes no position on unlisted senders.
SPF record ends with +all
The record authorises the entire internet to send mail as this domain.
SPF record exceeds the 10 DNS lookup limit
Evaluating this SPF record needs more than the 10 DNS lookups the specification permits.
SPF record has mechanisms after the all term
Terms placed after all are never evaluated.
SPF record has no all mechanism
The record does not say what to do about senders it has not listed.
SPF record is close to the 10 lookup limit
This record is within one or two lookups of the point where SPF fails permanently.
SPF record uses the deprecated ptr mechanism
ptr is slow, unreliable and explicitly discouraged by the specification.
Common questions
- Why does my SPF record fail when it looks correct?
- The most common cause is the ten DNS lookup limit. Each include costs a lookup, and every include pulls in that provider's own record, whose mechanisms count too. A record with six includes can easily need fifteen lookups. Once you exceed ten, receivers return a permanent error for all of your mail, not just the senders past the tenth lookup.
- Can I have two SPF records?
- No. The specification allows exactly one. When a receiver finds two it returns a permanent error and stops — it does not merge them or pick one. If a second sending service told you to add a TXT record, its mechanisms must be merged into your existing SPF record instead.
- Should my record end in ~all or -all?
- Start with ~all, which marks unlisted senders as a soft failure. Once you have confirmed over a week or two that no legitimate mail is failing, tighten it to -all for a hard failure. Never use +all, which authorises the entire internet to send as your domain.
Related tools
- Full domain health checkCheck SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT and BIMI for any domain in one pass, with the exact records and the fix for anything that is wrong.
- DMARC checkerLook up and validate a domain's DMARC record, read back what its policy actually does, and see what is needed to move to enforcement.
- DKIM checkerCheck a DKIM selector for a domain, validate the record, and read the key strength. Leave the selector blank to probe the selectors common providers use.
- MX lookupList a domain's mail exchangers and priorities, confirm each resolves to a reachable address, and catch the misconfigurations that break inbound mail.