SPF Record Checker
Reads the SPF record for a domain, follows every include:, and counts the DNS lookups against the 10 that RFC 7208 allows. Static analysis, not a test of one sender address.
About
SPF lets a domain publish which servers may send mail for it. It also carries a limit that catches most people out: a single record may cause at most ten DNS lookups, and going over means a permanent error and failed mail. This checker reads the published record, follows every include, counts the lookups and points out the mistakes that are easy to miss.
How to use
- Enter a domain name, without https:// or a path.
- Submit to read the record and follow its includes.
- Check the lookup count against the limit of ten, then read the warnings for anything worth fixing.
Frequently asked questions
What counts towards the ten lookup limit?
The include, a, mx, ptr and exists mechanisms, plus any redirect. Every lookup made while evaluating an included record counts too, which is why a single include can consume several.
Why does my record look fine but mail still fails?
Common causes are two SPF records on the same name, an include pointing at a domain with no record, or the total lookups exceeding the limit. All three are checked here.
Should I end with -all or ~all?
-all rejects anything not listed, which is what you want once the list is complete. ~all only marks the message and is easier during a migration, but it gives receivers less reason to trust the record.
Does this test a real sender?
No. It analyses the published record rather than sending a message, so it cannot tell you whether a particular IP passes. It does catch the structural faults that cause most failures.