Skip to content
correct.email
correct.email

SPF record checker

Validates the SPF record of a domain, follows every include and redirect, and counts DNS lookups against the limit of 10 that receivers enforce.

A domain such as example.com. You can paste a URL or an email address.

How this check works

We query the domain’s TXT records through public recursive resolvers and select records that start with exactly “v=spf1”, the same way receiving mail servers do (RFC 7208, section 4.5).

Every include and redirect target is fetched and analyzed recursively. We count each term that needs a DNS query — include, a, mx, ptr, exists and redirect — across the whole tree, plus “void” lookups that return no data. The count assumes the worst case: a sender that matches nothing until the end of the record, which is when the limits bite.

The a and mx mechanisms are resolved so you can see which addresses they authorize. Problems inside a provider’s record (for example your email service’s include) are labeled as such, because you can’t change them.

Limitations

  • Macros such as %{i} or %{s} depend on the actual message, so terms that use them are counted but not resolved.
  • You see the record as DNS serves it now. Resolvers elsewhere may still hold an older copy until its TTL expires.
  • SPF checks the envelope sender (Return-Path), not the From address people see. Whether that matters for delivery is decided by DMARC alignment.
  • Checked domains are not stored or logged.

Frequently asked questions

What does the 10 DNS lookup limit mean?

RFC 7208 allows at most 10 terms that trigger DNS queries (include, a, mx, ptr, exists and redirect) during one SPF evaluation, counting nested includes. Above that, receivers return “permerror” and many treat the message as unauthenticated. ip4, ip6 and all do not count.

Should I end my record with ~all or -all?

Both tell receivers that unlisted servers are not authorized. -all (fail) is stricter; ~all (softfail) is widely used together with DMARC, which then decides what happens to failing mail. Never use +all, which authorizes every server on the Internet.

Can a domain have two SPF records?

No. With more than one “v=spf1” record, receivers return permerror and SPF fails for all mail. Merge them into a single record, keeping one “v=spf1” at the start and one “all” at the end.

How do I fix “too many DNS lookups”?

Remove includes for services you no longer use, replace a and mx mechanisms with ip4/ip6 ranges for your own servers, and avoid ptr. If you still exceed the limit, move bulk mail services to a subdomain with its own SPF record. “Flattening” includes into IP lists works but breaks silently when providers change their addresses.

My SPF record passes, but my mail still goes to spam. Why?

SPF is one signal. Receivers also look at DKIM, DMARC alignment, sender reputation, content and complaint rates. Check DKIM and DMARC, then look at the Authentication-Results header of a delivered message with the header analyzer.