SPF Record Checker

Q: My SPF lookup count looks fine but mail still fails at 10+ lookups elsewhere — why?

Different validators handle void lookups and macro expansion differently, and some enforce a related but separate 2-void-lookup limit. Treat a count near the boundary as a warning sign to reduce includes.

Look up a domain's published SPF record, validate its syntax, and get a recursive DNS lookup count — including lookups hidden inside nested include: mechanisms.

Domain

Live check — resolves your domain's SPF record via Cloudflare DNS over HTTPS at request time, evaluated against RFC 7208. See the full methodology page.

What this checks

This tool fetches the domain's TXT records, finds the one starting with v=spf1, and walks through every include:, a, mx, exists, and redirect mechanism — recursing into each included domain's own SPF record — to produce a total DNS lookup count against the RFC 7208 limit of 10. It also flags common problems: multiple SPF records (only one is allowed), a missing or overly permissive all mechanism, and records approaching the 255-character single-string limit.

This is a best-effort client-side evaluator, not a full RFC 7208 implementation — it doesn't evaluate SPF macros (%{i}, %{d}, etc.) or IP-specific matching, and treats redirect as an additional lookup rather than fully substituting the evaluation. For a production mail flow, cross-check against your mail provider's own tools before making changes.

Need to build a new SPF record instead?

Use the SPF Record Generator to build one from scratch by picking your mail senders.

Why do I have two SPF records and does that break anything?

Yes — RFC 7208 requires exactly one SPF-type TXT record per domain. Two separate v=spf1 records is treated as a PermError by compliant receivers, which typically causes SPF to fail entirely rather than just being ignored. Merge them into a single record with multiple mechanisms.

My lookup count looks fine here but mail still fails SPF at 10+ lookups elsewhere — why?

Different validators handle "void lookups" (queries that return no answer, like DNS errors) and macro expansion differently, and some enforce a related but separate 2-void-lookup limit. If you're right at the boundary, treat this tool's count as a warning sign to reduce includes rather than an exact pass/fail guarantee.