SPF Record Checker
Enter a domain to validate its SPF record: whether it exists, how many DNS lookups it costs (the RFC 7208 limit is 10 — exceeding it causes a PermError that fails SPF for every message), and whether it ends in a strict -all. We resolve the whole include: chain, not just the top record.
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- Whether an SPF (v=spf1) TXT record exists
- The total DNS-querying mechanisms across the include chain vs the limit of 10
- The terminal all-qualifier (-all hard fail, ~all soft fail, ?all/+all weak)
- The published record itself
How to read the result
- OK = a valid record within the 10-lookup limit ending in -all or ~all.
- Fail (no SPF) = senders can be spoofed and mail is often spam-foldered.
- Fail (>10 lookups) = PermError; receivers treat SPF as failed. Flatten the include chain.
- Warn (+all/?all/no all) = the record authorizes too much and gives little protection.
Frequently asked questions
What is the SPF 10-lookup limit?
RFC 7208 caps the DNS-querying mechanisms (include, a, mx, ptr, exists, redirect) at 10 per evaluation. Going over causes a PermError, which most receivers treat as an SPF failure for every message.
How do I fix too many SPF lookups?
Remove unused vendor includes, or flatten includes into ip4:/ip6: ranges so the total DNS-querying mechanisms stay at or below 10.
What's the difference between -all and ~all?
-all (hard fail) says only the listed senders are authorized; ~all (soft fail) is a softer stance. ?all (neutral) and +all (pass all) provide essentially no protection.
Does this follow include: chains?
Yes — it resolves every include: and redirect= recursively and sums the lookups, so you see the real total, not just the top-level record.