Skip to content
inboxprobe

Checkers

Generators

Guides

Checkers

SPF record checker

Expands every include, counts DNS lookups against the limit of 10 and tells you in plain words what's wrong — with the corrected record to paste.

What SPF does, in one paragraph

SPF is a TXT record at the root of your domain that lists the servers allowed to send mail using your domain in the envelope sender (the bounce address). Receivers look it up for every message. It doesn't check the From address people see — that's what DMARC adds, by requiring SPF or DKIM to pass for a domain that aligns with the From.

A typical record: Google Workspace plus SendGrid

Type
TXT
Host / name
@
Value
v=spf1 include:_spf.google.com include:sendgrid.net ~all

The 10-lookup limit (and why most checkers undercount)

RFC 7208 caps the terms that trigger DNS queries — include, a, mx, ptr, exists and the redirect modifier — at 10 per evaluation, counted across every nested record. ip4, ip6 and all are free. Go over and receivers return a permanent error (permerror): SPF fails for all your mail, which usually means DMARC fails too.

Term in your recordLookups it costsWhy
include:_spf.google.com41 for the include + 3 nested includes in Google's record (at the time of writing)
include:spf.protection.outlook.com21 + 1 nested include
include:sendgrid.net1Only ip4 ranges inside
mx1Plus up to 10 address lookups that don't count toward the 10, but more than 10 MX hosts is an error
ip4:203.0.113.0/240No DNS needed

Providers change their own records, so a record at 9 lookups today can break tomorrow without you touching it. We evaluate the live records each time and show the cost of each include.

Getting under 10

  • Remove includes for services you've stopped using — the most common cause.
  • Replace a and mx with ip4: ranges if your own servers rarely change.
  • Move marketing or bulk mail to a subdomain (news.example.com) with its own SPF record and its own 10 lookups.
  • "SPF flattening" (replacing includes with IP lists) works but goes stale when providers change IPs — only do it with automation that refreshes it.

Void lookups

A void lookup is a term whose DNS query returns nothing — an include: of a domain that no longer exists, a: for a deleted host. RFC 7208 lets receivers fail SPF after two of them. They're usually leftovers from an old provider. We list each one by name.

~all, -all, ?all, +all: what the ending means

EndingMail from unlisted serversUse it when
~all (soft fail)Fails SPF "softly"; DMARC then decidesDefault choice once you have DMARC — Google and most providers suggest it
-all (hard fail)Fails SPF outrightYou're sure every sender is listed (Microsoft's docs use it)
?all (neutral)No opinionShort tests only
+all (pass)Passes — anyone can send as youNever

With DMARC at quarantine or reject, ~all and -all protect you equally: DMARC is what tells receivers to act. -all can make some receivers reject forwarded mail before DMARC even runs, which is why many people prefer ~all.

Errors we catch

  • Two SPF records. Each provider tells you to "add a TXT record" and people add a second v=spf1. Two records = permerror. Merge them into one.
  • Typos like inlcude:, ip4: with a hostname, a missing colon, or a CIDR like /33.
  • Includes that point nowhere, loops between records, or more than 10 MX hosts behind mx.
  • No `all` at the end, so unlisted servers get a neutral result.
  • Very wide ranges such as ip4:0.0.0.0/1, which authorise half the internet.
  • `ptr`, which RFC 7208 says not to use.

Questions

Can I have two SPF records if one is for a different service?

No. A domain must have exactly one TXT record starting with v=spf1. With two, receivers return a permanent error and SPF fails for every message. Combine all the include: and ip4: terms into one record with a single all at the end.

Do ip4 and ip6 count toward the 10 lookups?

No. Only include, a, mx, ptr, exists and redirect cost DNS lookups. ip4, ip6 and all are evaluated without DNS, so listing IP ranges is the way to add senders without spending lookups.

Should I use ~all or -all?

With DMARC in place, ~all is the common recommendation: DMARC decides what happens to failing mail, and ~all avoids some receivers rejecting forwarded mail on SPF alone. Use -all if you're confident every legitimate sender is listed.

Is SPF enough for Gmail and Yahoo?

For low-volume senders, SPF or DKIM is the minimum. Bulk senders (about 5,000+ messages a day to Gmail) need SPF, DKIM and DMARC, with the From domain aligned to SPF or DKIM. Set up DKIM regardless: SPF breaks when mail is forwarded, DKIM survives.

Why does my SPF pass but DMARC fails?

SPF checks the envelope sender (Return-Path), which is often the sending service's domain, not yours. DMARC needs SPF to pass for your From domain. Configure a custom return-path/bounce domain with the service, or rely on DKIM signing with your domain.

Sources

Last reviewed: