SPF record checker
Read your SPF record, count the DNS lookups against the limit of ten, and see exactly what to change.
What this checks
Four things we read off your record.
The record and its parts
Each include, a, mx, ip4 and ip6 written out in plain words, so you can see which service each one lets send.
The ten lookup limit
We follow your includes into their own records and count the lookups they add. Past ten, a receiving server stops reading and the check fails.
More than one record
A domain may publish one SPF record. With two, receiving servers treat it as a fault and neither one counts.
How the record ends
-all, ~all, ?all or +all: what happens to a message from a server you never listed. This is the part that decides whether SPF does anything.
How to fix it
One record, every sender, under ten lookups.
Most broken SPF records come from a service added years ago and never taken out. These are the steps to get back to one record that works.
- 01
List every service that sends mail as you
Your mailbox provider, the newsletter tool, the invoicing app, the help desk, the form on your site. Anything that sends with your domain in the From line belongs in the record.
- 02
Put them in one record
Each service publishes the include to use, and it is in their setup page. One TXT record on the domain itself, with every include in it.
v=spf1 include:_spf.google.com include:servers.mcsv.net -all
- 03
Get under ten lookups
Drop includes for services you stopped using. Where a provider publishes a stable list of addresses, swap the include for those ip4 and ip6 entries, which cost no lookup at all. Includes that return nothing still cost a lookup, so take them out.
v=spf1 ip4:198.51.100.0/24 include:_spf.google.com -all
- 04
End it with -all
~all lets mail from anywhere else through with a mark on it. -all makes it fail, which is the point of publishing the record. Move across once your DMARC reports show no real sender failing.
v=spf1 include:_spf.google.com -all
Questions
The things people ask next.
What is an SPF record?+
A TXT record on your domain that lists the servers allowed to send mail using your name. A receiving server reads it, compares the address the message arrived from, and uses the answer as one half of the DMARC check.
Why is there a limit of ten lookups?+
The SPF standard caps the DNS lookups a receiving server has to make while checking one message, so a single record cannot fan out into hundreds of queries. Over the limit the check returns a permanent error, and most receivers treat that as a failure.
Can a domain have two SPF records?+
No. A domain publishes one. When a receiving server finds two, the result is a permanent error and neither record is used. Merge the includes from both into a single record.
What is the difference between ~all and -all?+
~all is a soft fail: a message from a server you did not list is still accepted, with a mark on it. -all is a hard fail. Many setups start on ~all while they find their senders, then move to -all.
The same work, every client
Your AI can run this and 800+ more checksfor every client.
The email deliverability audit runs this check and the rest of them on every domain you work with, then writes the fix list your client can hand to their IT person.