Free tool
SPF checker
Enter a domain to check its SPF record: whether receivers accept it, where its ten DNS lookups go, and whether a server you're adding is covered.
Sending outreach from this domain? GEOboom finds the pages AI answers cite and runs the outreach to get you mentioned on them, with the mailboxes included.
See how it worksHow receivers read an SPF record
Left to right
The receiver checks the sending server's IP against each term in order: ip4 and ip6 ranges, the addresses of a and mx, and every include. The first match decides.
Ten lookups
Every include, a, mx, exists and redirect costs a DNS lookup, counted through every nested include. Past ten, the whole record fails.
Then the ending
No match means the ending applies: ~all marks the message suspicious, -all asks for it to be rejected. +all lets anyone through and should never be used.
Questions
What does an SPF checker check?
It reads the TXT record starting v=spf1 on your domain and checks what receivers check: that there is exactly one, that its syntax is valid, that following every include costs no more than 10 DNS lookups, and how it ends. It can also test whether a particular server's IP is allowed to send for you.
Why does the 10-lookup limit matter so much?
Past ten lookups, receivers stop evaluating and return a permanent error, which counts as SPF failing for every message you send. It creeps up unnoticed: each service you add brings an include, and some includes contain several more. The breakdown above shows which include costs what.
I'm over the limit. What do I remove?
First anything that no longer sends for you: old newsletter tools, a CRM you left. Then look at the costliest includes. A service that sends only marketing or notifications can usually send from a subdomain, such as news.yourdomain.com, with its own SPF record, which takes its lookups off the main domain. Flattening includes into IP addresses also works, but goes stale when the provider changes its ranges.
Can I have two SPF records?
No. With two or more, receivers treat SPF as broken. Merge them into one record that keeps every include and address, with a single ending. When we find two, we show the merged record to publish.
What does a soft fail mean for my mail?
The IP isn't listed and the record ends in ~all, so receivers mark the message suspicious rather than rejecting it. If DKIM still passes for your domain, DMARC passes and the message is usually fine. If neither passes, your DMARC policy decides what happens.
How does the checker count SPF lookups?
Like a receiver does: it follows every include and redirect, nested as deep as they go, and counts each term that needs a DNS query, which are include, a, mx, ptr, exists and redirect. ip4, ip6 and all cost nothing. The breakdown shows what each include costs, including the includes inside it. It also counts lookups that return nothing, since more than two of those is a permanent error too.
How does the IP test work?
It runs the record against the address the way a receiving server would (RFC 7208): term by term from the left, following includes and the addresses behind a and mx, until something matches. Macros built from the IP or the domain are expanded, which covers includes like Salesforce's. A term that depends on the message itself, such as the sender's address, or on ptr, is reported as something we couldn't evaluate rather than guessed. The result names the term that matched, so you can see which include lets the server through.