Check an SPF record
See a domain's SPF record, every mechanism in it explained, and the DNS lookups it really needs once every include is followed. No account.
Want SPF that stays within the limit?
Sending through Email Digit adds one include to your SPF record, and we keep the addresses behind it current, so a change on our side never needs a change in your DNS. We also publish and maintain your DKIM keys and DMARC record.
What an SPF record does
SPF lists the servers allowed to send mail for your domain. Receivers check the server a message came from against that list, and DMARC uses the result to decide whether to trust the message.
Why the lookup count matters
Every include points to another provider's record, which can include more records of its own. The limit of 10 applies to the whole tree, so a record with four includes can still need eleven lookups. Providers change their records without telling you, which is how a working SPF record breaks on its own.
What the checker looks for
A missing or duplicate record, the lookup count across every nested include, lookups that return nothing, mechanisms that are not valid SPF, deprecated ptr, include loops, and what the record says about servers it does not list.
SPF record questions
What is the 10 lookup limit?
A receiver checking SPF may make at most 10 DNS lookups for include, a, mx, ptr, exists and redirect, counted across every record your includes pull in. At 11 it stops and returns a permanent error, and SPF fails for all of your mail. ip4, ip6 and all cost nothing.
Can I have two SPF records?
No. With two TXT records starting v=spf1, receivers return a permanent error. Merge them into one record with a single all at the end.
Should I end with ~all or -all?
Either works once DMARC is in place, because DMARC decides what happens to failing mail. ~all is the safer start while you are still finding every service that sends for you. Never use +all: it lets anyone pass.
Is flattening a good fix for too many lookups?
It works, with a cost. A flattened record lists your providers' addresses as they are today, and goes stale when a provider changes them. Mail from the new addresses then fails SPF with no warning. Removing includes you no longer use is the better first step.
What is a void lookup?
A lookup that comes back with no records at all, usually an include or a host that no longer exists. More than two of them is also a permanent error.