SPF Checker
ServerValidate an SPF record and count its DNS lookups against the limit of 10.
How it works
Check a domain's SPF record — which servers are allowed to send mail as that domain. We validate the syntax, count the DNS lookups against SPF's hard limit of 10, and explain what the policy actually does.
Try an example
This check runs from our server so it can query DNS directly — the domain you enter is sent to our backend. Nothing is stored.
How this works: the domain you enter is sent to our server so it can query DNS directly and see what a receiving mail server sees. Nothing is stored.
About the SPF Checker
SPF (Sender Policy Framework) is the DNS record listing which servers may send email as your domain. This free SPF checker fetches your record, validates its syntax, counts the DNS lookups it triggers against the hard limit of 10, and explains what your policy actually does with mail from unlisted servers.
Exceeding the lookup limit is the single most common SPF failure — and it silently breaks authentication.
The 10-lookup limit
Every include:, a, mx, ptr, exists: and redirect= in your record costs one DNS lookup, and nested includes count too. Go over ten and SPF returns a permanent error, which most receivers treat as a failure — so adding one more provider can break authentication for all your mail. Direct ip4: and ip6: entries cost nothing, so replacing includes with IP ranges is the usual fix.
Choosing your all mechanism
- -all (Fail) — reject mail from unlisted servers. The strongest, and the goal.
- ~all (SoftFail) — accept but mark it. Sensible while you're still finding senders.
- ?all (Neutral) — no protection at all.
- +all — authorises the entire internet to send as you. Never use it.
Frequently asked questions
What does 'too many DNS lookups' mean?
SPF allows a maximum of 10 DNS lookups when evaluating your record. Beyond that it returns a permanent error and receivers treat SPF as failed. Reduce includes or replace them with explicit IP ranges.
Can I have two SPF records?
No. Exactly one SPF record per domain is allowed — publishing two makes SPF fail entirely. Merge them into a single record instead.
Should I use -all or ~all?
Use ~all while you're confirming every legitimate sender passes, then move to -all for full protection once you're confident.
Does SPF alone stop spoofing?
No. SPF validates the envelope sender, not the From address a recipient sees. You need DKIM and DMARC as well to stop display-name spoofing.