SPF Record Checker
Validate an SPF record against RFC 7208: counts the 10 DNS lookups, walks every include, flags +all, multiple records and syntax errors.
Your query is sent only to the resolver shown; this site keeps no logs. Copy link to this result
What this checks
Fetches the SPF TXT record, parses every mechanism and modifier, and recursively follows include: and redirect= to count DNS lookups against the limit of 10.
Shows the include tree so you can see which provider consumes the budget.
If it fails
- Too many lookups: remove unused includes, replace a/mx with ip4/ip6, or use a provider that flattens.
- Multiple records: merge them into one; receivers treat two records as permerror.
- +all: replace with -all or ~all immediately.
FAQ
Why is 10 the limit?
RFC 7208 §4.6.4 caps DNS-querying mechanisms at 10 to prevent abuse; exceeding it yields permerror and SPF is ignored.
Is ~all or -all better?
-all is strictest; many use ~all with DMARC enforcing. With DMARC in place either works; without DMARC, -all protects more.
Do ip4 and ip6 count as lookups?
No. Only include, a, mx, ptr, exists and redirect count.
My provider says SPF is fine but this shows an error?
Check the include tree: errors inside an included domain still break your record.