SPF record checker
Look up a domain's SPF record, follow every include, count DNS lookups against the limit of 10 and catch the mistakes that make SPF fail.
The full include tree and lookup count appear here.
SPF mechanisms
| Mechanism | Matches | Lookup? |
|---|---|---|
| ip4:203.0.113.0/24 | That IPv4 address or range | No |
| ip6:2001:db8::/32 | That IPv6 range | No |
| include:_spf.google.com | Whatever that domain's SPF allows | Yes |
| a / mx | The domain's A/AAAA or MX hosts | Yes |
| redirect=other.com | Use another domain's SPF entirely | Yes |
| -all / ~all | Everything else: fail / softfail | No |
Over the limit? Remove includes for services you no longer use, replace a/mx with explicit ip4 ranges, or send bulk mail from a subdomain with its own SPF.
Questions people ask
What is an SPF record?
A TXT record starting
v=spf1 that lists which servers may send email for your domain (RFC 7208). Receivers compare the sending server's IP with the list and use the result, together with DKIM and DMARC, to decide whether to trust the message.What is the 10 DNS lookup limit?
Evaluating SPF may trigger at most 10 DNS-querying mechanisms (
include, a, mx, ptr, exists, redirect), counted recursively through includes. Exceed it and the result is PermError, which DMARC treats as a failure. ip4, ip6 and all are free.~all or -all?
-all (fail) tells receivers to reject mail from unlisted servers; ~all (softfail) says treat it as suspicious. With DMARC enforcing, ~all is the common, safe choice; +all allows anyone and should never be used.Can I have two SPF records?
No. Multiple
v=spf1 records on one name cause a PermError. Merge them into one record with multiple includes.