SPF Checker
Check that your SPF record is valid, see every include it pulls in, and find out how many of the 10 allowed DNS lookups it uses. Going over 10 quietly breaks SPF for every message you send.
What SPF does
SPF is a TXT record that lists the servers allowed to send email for your domain. When a message arrives, the receiving server looks at the IP it came from and checks it against your list. A match is a pass. No match gives a fail or soft fail, depending on how your record ends.
A typical record looks like this:
v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.10 ~allIt says: Google Workspace may send, SendGrid may send, the server at 203.0.113.10 may send, and anything else should be treated with suspicion.
The 10 lookup limit
Every include, a, mx, exists and redirect makes the receiving server do a DNS lookup, and so do the includes inside those includes. SPF stops at 10. Past that, the result is a PermError, which most receivers treat the same as having no SPF at all. Nothing warns you when this happens; your mail just starts doing worse.
Adding sending services can increase the number of DNS-lookup mechanisms. The expanded result shows the terms it counted. ip4 and ip6 do not consume the ten lookup-term allowance.
Fixing common problems
- Two SPF records: you are only allowed one. Merge them, keeping every entry, with a single
allat the end. - Too many lookups: remove services you no longer use. Then look at which includes are expensive; some providers offer a smaller include for specific products.
- Include without SPF: usually a typo or a service that changed its include name. Check the provider's current setup instructions.
- Ending with
+all: this lets anyone send as you. Change it to~all.
Limitations
- We do not expand SPF macros such as
%{i}, because their result depends on each message. We count the lookup and tell you it is there. - A pass here means the record is valid. Whether a particular email passes depends on which server actually sent it. Paste its headers into the Email Header Analyzer to see the real result.
Questions
Should I use -all or ~all?
If you also have DMARC, ~all is the common choice and is safe: DMARC decides what happens to failing mail. -all asks receivers to reject outright, which can lose legitimate mail if you forgot a service. Start with ~all.
Do I need SPF on subdomains?
SPF is checked on the exact domain in the envelope sender, and subdomains do not inherit it. If you send from news.example.com, that name needs its own record. Many sending services handle this by using their own bounce domain.
What about domains that never send email?
Publish v=spf1 -all. It tells receivers that no server may send for the domain, which stops spammers using it.