SPF record checker
Validate a domain's SPF record, expand every include and redirect, and count DNS lookups against the limit of 10.
A domain, an email address or a URL. Lookups go from your browser to Cloudflare's public DNS (1.1.1.1); nothing is sent to simmail.
What an SPF record is
SPF (Sender Policy Framework, RFC 7208) is a TXT record that lists the servers allowed to send mail for a domain. A receiving server takes the domain from the message's envelope sender (the Return-Path), fetches that domain's SPF record and checks whether the connecting IP address is on the list. The record is read left to right: ip4 and ip6 list addresses, include pulls in a provider's own record, a and mx allow the domain's own hosts, and all at the end says what to do with everyone else.
Why it matters
Since February 2024, Gmail and Yahoo require every sender to have SPF or DKIM, and bulk senders (more than 5,000 messages a day to Gmail) to have both, plus DMARC. SPF is also one of the two ways a message can pass DMARC. A broken record does not just stop protecting you: it can make your own mail fail authentication and land in spam or bounce.
Common mistakes
- Too many lookups. Each provider's include often contains more includes. Add a CRM, a help desk and a newsletter tool to Google Workspace or Microsoft 365, and the total easily passes 10, at which point SPF fails for all of your mail. This checker expands the whole tree so you can see where the lookups go.
- Two SPF records. A new provider's setup guide says "add this TXT record", and you end up with two records starting
v=spf1. That is a permanent error; merge them. - Ending in
+allor?all.+allauthorises the whole internet.?allgives no protection. - Using
ptr. RFC 7208 says not to: it is slow and unreliable, and some receivers skip it. - Typos.
ip:instead ofip4:,include=instead ofinclude:, or a missing space between terms all make the record invalid. - Includes pointing at names with no SPF. An include of a domain without an SPF record is a permanent error, and counts as a void lookup.
Lookups are counted as the worst case: a receiver stops evaluating at the first mechanism that matches, so it may use fewer. Mechanisms with macros (such as %{i}) depend on each message and are counted but not expanded. Need a new record? Use the SPF generator.
Questions
What counts towards the 10-lookup limit?
Every include, a, mx, ptr and exists mechanism and the redirect modifier, including those inside the records you include (RFC 7208 4.6.4). ip4, ip6 and all cost nothing. Past 10, receivers return a permanent error and SPF fails.
What is a void lookup?
A lookup that finds nothing: the name does not exist or has no records of the type asked for. RFC 7208 allows two; a third is a permanent error. Remove terms that point at names that no longer exist.
Should I use ~all or -all?
Both are fine once every service that sends as you is listed. ~all (soft fail) is the common choice when DMARC is in place, because DMARC decides what happens to failing mail. -all (fail) is stricter. Avoid ?all, which protects nothing, and never use +all.
Can I have two SPF records?
No. A domain must publish exactly one TXT record starting with v=spf1. With two, receivers return a permanent error. Merge them into one.
Does SPF alone stop spoofing?
No. SPF checks the envelope sender (Return-Path), which people don't see. To protect the From address, you need DMARC, which requires SPF or DKIM to pass for a domain that matches From.
How do I get under 10 lookups?
Remove includes for services you no longer use, replace a and mx with the ip4/ip6 addresses they resolve to, or send bulk mail from a subdomain with its own SPF record.
Your DNS is right. Now see how real people react to your email
simmail sends your app's mail to simulated people who open, ignore, junk, click and reply, so you can test what happens after delivery. Start free, no card.