Skip to content

SPF record checker

Paste a domain to see its SPF record, how many of the 10 allowed DNS lookups it uses (counting nested includes), and what to fix.

What a healthy SPF record looks like

Exactly one TXT record at the root of the domain, starting with v=spf1, listing every service that sends as you, and ending with ~all (soft fail) or -all (hard fail). For example: v=spf1 include:_spf.google.com include:sendgrid.net ~all

The most common SPF mistakes

Two SPF records. Each tool’s setup guide says "add this TXT record", so people end up with two. Receivers then return a permanent error and SPF fails for every message. Merge them into one.

Too many lookups. Every include:, a, mx, ptr, exists and redirect costs a DNS lookup, and the includes inside includes count too. Past 10, SPF fails. This checker walks the whole tree so you can see which include is expensive.

Ending in +all or nothing at all. +all authorises the whole internet. A missing all gives a neutral result, which protects nobody.

Monitor it instead of checking by hand

Get an email if your SPF record changes or starts failing. Plans from $9/month after a 14-day free trial. No card to start.

Start free trialSee pricing

Questions

Should I use ~all or -all?

Both are fine once DMARC is in place, because DMARC makes the final decision. ~all is the safer default while you are still finding all your senders. -all is stricter and suits domains where you are sure every sender is listed.

Does the include for my email provider go on the root domain?

Usually, yes, for mailbox providers like Google Workspace or Microsoft 365. Bulk senders such as SendGrid, Mailgun or Amazon SES often use their own bounce subdomain, so they may not need an include on your root at all. Check their setup screen.

How do I fix "too many DNS lookups"?

Remove includes for services you no longer use first. If you are still over 10, replace an include with the fixed ip4:/ip6: ranges it resolves to (only for providers whose ranges rarely change), or move a bulk sender to its own subdomain.

More free checks

Check a provider setup