SPF Checker
Validate SPF and count DNS lookups against the limit of 10.
Enter a domain to look up its SPF record and check which servers are allowed to send mail for it. We read the live record straight from DNS over an encrypted connection. Nothing is stored.
The SPF Checker looks up the Sender Policy Framework record published in your domain's DNS, parses it, and counts how many DNS lookups it triggers. SPF (defined in RFC 7208) lists which servers are allowed to send mail for your domain. Receiving servers evaluate it to decide whether the sending IP is authorised, and the result feeds into DMARC alignment. A valid, lean record is essential for both deliverability and anti-spoofing.
The 10-lookup limit
SPF mechanisms such as include, a, mx, ptr and exists, and the redirect modifier, each trigger DNS queries. RFC 7208 caps the total at 10 DNS lookups; exceed it and compliant receivers return a permerror, which usually means SPF stops authenticating your mail. The checker counts these for you, follows nested include chains, and flags when you are close to or over the limit. It also warns about void lookups (queries returning no record), which are capped at two.
Reading and fixing the result
Check three things in the output:
- One record only. A domain must publish exactly one SPF record; two or more
v=spf1records is a permerror. - The all mechanism.
-allis a hard fail and is recommended for enforcement;~allis a soft fail;+allis dangerous and authorises anyone. - Lookup count. If you are over ten, remove unused
includeentries, replacea/mxwith explicitip4/ip6ranges, and avoidptr, which is deprecated.
If flattening leaves you near the cap, our SPF Generator can rebuild a tidier record, and DMARC Engine can keep a flattened record maintained automatically. See the requirements for full alignment guidance.
Frequently asked questions
Why does the 10-DNS-lookup limit matter?
RFC 7208 limits SPF evaluation to ten DNS lookups. If your record needs more, conforming receivers return a permerror and treat SPF as failed, which can hurt deliverability and break DMARC alignment for that path.
Which mechanisms count towards the lookup limit?
include, a, mx, ptr, exists and the redirect modifier each cost lookups, and nested includes add their own. Plain ip4 and ip6 mechanisms cost nothing because they require no DNS query.
What is the difference between -all and ~all?
-all is a hard fail: mail from unlisted servers should be rejected. ~all is a soft fail: such mail is accepted but marked suspicious. -all is the stronger setting for anti-spoofing once you are confident every legitimate sender is listed.
Can I have more than one SPF record?
No. A domain must publish exactly one v=spf1 record. Two or more produces a permanent error, and receivers may ignore SPF entirely. Merge all your senders into a single record instead.
Why should I avoid the ptr mechanism?
The ptr mechanism is deprecated by RFC 7208 because it is slow, unreliable and easy to abuse. Use explicit ip4/ip6 ranges or include the provider's published SPF instead.
I am over the limit. How do I fix it?
Remove includes for senders you no longer use, replace a and mx with the explicit IP ranges they resolve to, and consider flattening third-party includes into ip4 entries. The SPF Generator can help you rebuild a compliant record.