SPF record checker with a lookup counter
Paste up to 25 domains. We find each SPF record, follow every include and count DNS lookups against the limit of 10.
OK Worth fixing Broken Could not tell. Click a row for the records and the fix.
What the SPF check looks for
- No SPF record. Receivers cannot tell who may send for the domain.
- Two SPF records. Both are ignored.
- More than 10 DNS lookups. Counted recursively through every include, as RFC 7208 requires.
- An include that does not resolve. A deleted provider record breaks your whole SPF.
- +all or no all at the end. The record protects nothing.
A simple SPF record for your own mail server
example.com. 3600 IN TXT "v=spf1 ip4:203.0.113.10 a mx ~all"
Add include: only for services that really send as this domain, such as your newsletter tool or help desk.
Questions
What does "SPF too many DNS lookups" mean?
SPF allows at most 10 DNS lookups. Every include:, a, mx, ptr, exists and redirect counts, including the ones inside each include. Above 10 receivers return a permanent error and treat your SPF as broken. The checker counts them for you.
How do I fix too many SPF lookups?
Remove includes for services you no longer use, replace a and mx with ip4: ranges of your own servers, and avoid nesting several marketing tools. Each removed include usually saves 1 to 4 lookups.
Can a domain have two SPF records?
No. With two v=spf1 records receivers ignore both. Merge them into one record that ends with a single ~all or -all.
Should I use ~all or -all?
~all (soft fail) is the safe default while you set things up. -all (hard fail) is stricter. Never use +all: it lets anyone send as your domain.
Can I check SPF for many domains at once?
Yes. Paste up to 25 domains; the SPF column comes first and shows the lookup count for each domain.
More free tools: Mail health checker · DMARC checker · DKIM checker · MX lookup
Run 10, 30 or 100 domains?
MXDeck is a Mac email app with this check built in: one inbox for every contact@, and a red dot the day a domain’s mail breaks.