SPF Record Checker
Look up a domain's SPF record, expand every include, and count the DNS lookups against the RFC 7208 limit of 10.
What this SPF checker does
SPF (Sender Policy Framework) is a TXT record listing the servers allowed to send email as your domain. Checking that the record exists is easy. The hard part — and the reason most SPF records are quietly broken — is the DNS lookup budget.
RFC 7208 allows a receiving mail server to perform at most 10 DNS lookups
while evaluating your record. Every include:,
a,
mx,
exists and
redirect=
costs one. Crucially the count is transitive: if you include your ESP,
and they include three more domains, those three count against your budget.
Cross the limit and receivers return permerror.
SPF then fails for all your mail — not just mail from the offending sender.
Because a vendor can push you over the line by editing their own record, a domain that
passed last month can fail today with no change on your side.
So this tool resolves the whole tree. It fetches your record, follows every
include:
and redirect=
recursively the way a real receiver does, charges each lookup against the budget, and shows
you the tree so you can see exactly which branch is expensive.
Reading your result
- Lookup count — the headline number. At 11 or more, your SPF is failing right now.
- The
allqualifier —-allrejects unlisted senders,~allmarks them suspicious,?alldoes nothing, and+allauthorizes the entire internet. - The include tree — each node is one DNS lookup. Prune the branches you do not send from.
- Multiple records — more than one
v=spf1TXT record is a permanent error, not a merge.
SPF is one leg of email authentication. Check the other two with the DKIM checker and the DMARC checker, and confirm the domain can receive mail with the MX lookup.
Frequently asked questions
What is the SPF 10-lookup limit?
RFC 7208 caps SPF evaluation at 10 DNS lookups. Mechanisms like include:, a, mx, ptr, exists and redirect= each cost one lookup, and the count is transitive — an include's own includes count too. Exceed 10 and receivers return a permanent error, which means SPF fails for all of your mail, including legitimate messages. This is the single most common way SPF silently breaks.
Why does my SPF record suddenly exceed the limit when I did not change it?
Because the limit counts your vendors' records as well as your own. If you publish include:_spf.vendor.com and that vendor adds two more includes to their record, your lookup count rises without you touching your DNS. This is why the count should be checked periodically, not just when you edit your record.
How do I fix too many SPF DNS lookups?
Remove include: entries for services you no longer send from — this is usually the biggest win. Then replace includes whose IP ranges are stable with explicit ip4: and ip6: mechanisms, a technique known as SPF flattening. Be careful: flattened IPs go stale when the vendor changes infrastructure, so only flatten what you can monitor.
Should I use ~all or -all?
-all (hard fail) tells receivers to reject mail from servers not listed in your record, and is the correct end state. ~all (soft fail) marks such mail suspicious but usually still delivers it. Start with ~all while you confirm from DMARC reports that all your legitimate senders are covered, then move to -all. Never use +all — it authorizes the entire internet to send as your domain.
Can a domain have more than one SPF record?
No. RFC 7208 requires exactly one. If a domain publishes two TXT records beginning with v=spf1, receivers do not choose between them — they return a permanent error and SPF fails entirely. Merge the mechanisms from both into a single record.
Is SPF enough to stop spoofing on its own?
No. SPF authenticates the envelope sender, not the From: header your recipient actually sees, so an attacker can pass SPF with their own domain while displaying yours. You need DMARC to tie authentication to the visible From: address, and DKIM so that forwarded mail still authenticates.
More free tools
Email Checker
Validate syntax, MX and disposable status for any address.
MX Lookup
See which mail servers receive a domain's email.
DKIM Checker
Find DKIM selectors and check key strength.
DMARC Checker
Inspect your DMARC policy and reporting setup.
Disposable Checker
Detect throwaway and temp-mail domains.
Blacklist Checker
Check an IP or domain against DNS blocklists.
Need to verify a whole list?
This tool stops at DNS. The Mailvalid API confirms whether an individual mailbox actually exists over SMTP — in bulk, with 95%+ accuracy. Start with 100 free credits, no credit card.