SPF record checker and lookup counter.
Validate your SPF record, count DNS lookups against the 10-lookup limit, spot duplicate records and +all mistakes, and see which services you've authorised.
- Free, no sign-up
- Results in seconds
- 8 standards checked
- Email yourself the report
A guest list for your email.
SPF (Sender Policy Framework) is a TXT record on your domain that lists every server allowed to send email using your domain name: your mailbox provider, newsletter tool, CRM, website and anything else that sends on your behalf.
When a message arrives, the receiving server checks the sending IP address against your list. On its own SPF doesn’t stop spoofing of the address people see, but it’s one of the two signals DMARC relies on.
SPF mechanisms, explained.
- include:Pulls in another domain's SPF list, like include:spf.protection.outlook.com for Microsoft 365. Costs one DNS lookup, plus whatever that record uses.
- ip4: and ip6:Authorise specific addresses or ranges. Free: no DNS lookup needed.
- a and mxAuthorise your domain's own web or mail server addresses. One lookup each.
- redirect=Use another domain's SPF record in place of your own.
- -allHard fail: anything not listed fails SPF. The strictest ending.
- ~allSoft fail: unlisted senders are marked suspicious. Fine when DMARC is enforcing.
Why adding one more tool can break your email.
The SPF standard (RFC 7208) allows at most 10 DNS lookups while evaluating your record, counting every include, a, mx, ptr, exists and redirect, including the ones inside the services you include.
Go over 10 and SPF returns a permanent error: receivers treat your SPF as failed for every message. It’s the most common way a growing business breaks its email, one new marketing tool at a time. Our checker follows every include and gives you the real count.
What breaks SPF.
- More than one SPF recordTwo "v=spf1" records is a permanent error. Merge them into one.
- +allAuthorises every server on the internet to send as you. Never use it.
- Too many lookupsRemove services you no longer use, or replace includes with their IP ranges.
- Using ptrDeprecated, slow and ignored by some receivers.
Should my SPF record end in -all or ~all?
Both are valid. "-all" is stricter. Once DMARC is enforcing, many experts use "~all" because DMARC makes the final decision either way. Never use "+all" or "?all".
Can I have two SPF records?
No. A domain must have exactly one SPF record. Two records cause a permanent error, so merge every include into a single record.
What is the SPF record for Microsoft 365?
v=spf1 include:spf.protection.outlook.com -all, plus includes for any other services that send as your domain.
What is the SPF record for Google Workspace?
v=spf1 include:_spf.google.com ~all, plus includes for any other services that send as your domain.
SPF over the limit, or just messy?
We'll audit every service that sends as you, clean up your record and keep it under the lookup limit as you add new tools.
Tell us about your IT.
We answer almost every inquiry within one business day.