SPF Record Checker
Enter a domain to validate its SPF record, count its DNS lookups against the limit of 10, and find common mistakes.
Frequently asked questions
What is an SPF record?
SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers allowed to send email for it. When a message arrives, the receiving server checks the sending IP address against that list.
What is the SPF 10 DNS lookup limit?
SPF (RFC 7208) allows at most 10 terms that trigger a DNS lookup: include, a, mx, ptr, exists and redirect. They are counted across nested include records. If a record goes over the limit, receivers return a permanent error and SPF fails. Fix it by removing unused include entries or by flattening them into ip4 and ip6 ranges.
What is the difference between -all, ~all, ?all and +all?
-all (fail) tells receivers to reject mail from servers not listed. ~all (softfail) asks them to accept it but mark it suspicious. ?all (neutral) says nothing either way. +all allows any server to send as your domain and should never be used.
Why can a domain have only one SPF record?
If a domain publishes more than one TXT record starting with v=spf1, receivers treat it as a permanent error and SPF fails. Combine the entries into a single record instead.
What does include: do?
It tells receivers to also check another domain's SPF record, such as include:_spf.google.com for Google Workspace. Each include adds to the lookup count, and anything that record allows is allowed for you too.
Does a valid SPF record guarantee my email is delivered?
No. SPF is one signal. Inbox providers also look at DKIM, DMARC, your sending reputation and message content. SPF also checks the technical envelope sender, not the visible From address, which is why DMARC is needed to tie them together.