Why does my SPF record fail when it looks correct?

The most common cause is the ten DNS lookup limit. Each include costs a lookup, and every include pulls in that provider's own record, whose mechanisms count too. A record with six includes can easily need fifteen lookups. Once you exceed ten, receivers return a permanent error for all of your mail, not just the senders past the tenth lookup.

Can I have two SPF records?

No. The specification allows exactly one. When a receiver finds two it returns a permanent error and stops: it does not merge them or pick one. If a second sending service told you to add a TXT record, its mechanisms must be merged into your existing SPF record instead.

Should my record end in ~all or -all?

Start with ~all, which marks unlisted senders as a soft failure. Once you have confirmed over a week or two that no legitimate mail is failing, tighten it to -all for a hard failure. Never use +all, which authorises the entire internet to send as your domain.

Free toolSPF

SPF record checker

Look up a domain's SPF record, validate its syntax, and count the DNS lookups it costs, including every nested include, against the limit of ten.

Run the checkFree · no account

Problems this finds

One service on your list of approved senders didn't respond: When we checked, one service on your list gave no answer. It may be a temporary glitch, but if it stays broken, emails sent through that service may not be treated as approved.
An old, unused copy of your approved senders list is still there: Receivers ignore it, so it doesn't affect your email today. Removing it is a small tidy-up that avoids confusion the next time someone edits your domain's settings.
You have two lists of approved senders, which cancels both out: Only one list is allowed. With two, receivers ignore both, so every email you send fails this check and is more likely to land in spam or be rejected.
You have no list of approved senders: Receivers can't check that your emails come from services you actually use, so invoices and replies are more likely to be treated with suspicion. Gmail, Yahoo and Outlook expect businesses to have one.
Your list of approved senders has a typo in it: Part of the list isn't written correctly. Some receivers ignore the whole list when that happens, so the same email can pass at one company and fail at another.
Your list of approved senders points to services that no longer exist: These dead entries use up space on your list. If there are more than two, receivers treat the whole list as broken for every email you send.
Your list of approved senders doesn't turn anyone away: It says who may send as you but takes no position on everyone else, so receivers treat it much like having no list. A one-word change at the end makes it count.
Your settings approve anyone in the world to send email as you: Your list of approved senders ends with a setting that approves every server on the internet. Scammers can send email in your name and it will pass this check. That is worse than having no list at all.
Your list of approved senders is over its limit: Receivers stop reading a list that points to too many services, and then treat the whole list as broken. That affects every email you send, not just the ones from the last services listed.
Some services on your list of approved senders are being ignored: A service was added after the list's closing entry, and receivers stop reading there. Emails sent through that service aren't approved and may land in spam or be rejected.
Your list of approved senders doesn't say what to do with everyone else: It names who may send as you but never says that others may not, which weakens the protection it's meant to give. Adding a short ending to the list fixes it.
Your list of approved senders is close to its limit: Nothing is broken today, but a change made by one of the services you use could push it over and break the list for every email you send. Removing services you no longer use gives you room.
Your list of approved senders uses an outdated method: One entry uses an old, slow method that some receivers skip. Replacing it is a minor clean-up that makes your list more reliable and frees up room under its limit.

Common questions

Why does my SPF record fail when it looks correct?: The most common cause is the ten DNS lookup limit. Each include costs a lookup, and every include pulls in that provider's own record, whose mechanisms count too. A record with six includes can easily need fifteen lookups. Once you exceed ten, receivers return a permanent error for all of your mail, not just the senders past the tenth lookup.
Can I have two SPF records?: No. The specification allows exactly one. When a receiver finds two it returns a permanent error and stops: it does not merge them or pick one. If a second sending service told you to add a TXT record, its mechanisms must be merged into your existing SPF record instead.
Should my record end in ~all or -all?: Start with ~all, which marks unlisted senders as a soft failure. Once you have confirmed over a week or two that no legitimate mail is failing, tighten it to -all for a hard failure. Never use +all, which authorises the entire internet to send as your domain.