Free SPF Record Checker
Look up and validate your domain's SPF record, and count its DNS lookups against the limit of 10.
What a valid SPF record looks like
SPF is a single DNS TXT record on your root domain. It starts with v=spf1 and ends with an all qualifier:
v=spf1 include:_spf.google.com include:servers.mcsv.net ~allv=spf1The version. Every SPF record starts with this.
include:Authorises another sender (a lookup mechanism).
ip4: / ip6:Authorises specific IP addresses. No lookup, so it does not count.
-allHard fail: reject anything not listed. The strongest setting.
~allSoft fail: accept but mark unlisted senders. A safe starting point.
?all / +allNeutral or pass everything. These provide no protection.
The 10 DNS-lookup limit
SPF is allowed at most 10 DNS lookups when it is evaluated. Go over, and it returns a PermError and fails even for legitimate mail. These mechanisms each cost a lookup:
ip4 and ip6 do not cost a lookup, which is why flattening (replacing an include with its IP ranges) is the usual fix when you are over the limit.
Common SPF mistakes
- Publishing more than one SPF record, which makes SPF fail entirely.
- Going over the 10 DNS-lookup limit, causing a PermError.
- Ending with ?all or +all, which offers no protection.
- Leaving out senders such as your CRM or help desk, so their mail fails.
- Using ptr, which is deprecated and unreliable.
- Forgetting to re-check after adding a new sending service.
Related tools
Frequently asked questions
What is an SPF record?
SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are allowed to send email for your domain. Receiving servers check it to help decide whether a message is genuine, which reduces spoofing and improves deliverability.
What does a valid SPF record look like?
An SPF record is a single TXT record on your root domain that starts with v=spf1 and ends with an all qualifier. For example: v=spf1 include:_spf.google.com include:servers.mcsv.net ~all. The include mechanisms authorise other senders, and ~all soft-fails everything else.
What is the SPF 10 DNS lookup limit?
SPF may trigger at most 10 DNS lookups when it is evaluated (RFC 7208). The mechanisms include, a, mx, ptr, exists and redirect each cause a lookup. If your record needs more than 10, SPF returns a PermError and fails, even if the sender is legitimate. This checker counts your lookups so you can see how close you are.
How do I fix "too many DNS lookups"?
Remove includes for services you no longer use, and flatten nested includes where you can (replace an include with the IP ranges it resolves to). Some providers offer SPF flattening or macro-based records. Re-check after each change to confirm you are back under 10.
Can I have more than one SPF record?
No. A domain must publish exactly one SPF record. If it has two or more, SPF fails entirely with a PermError. Merge them into a single v=spf1 record with all the includes you need.