SPF Record Checker

Diagnose the number one SPF problem: the RFC 7208 limit of ten DNS lookups that turns into a PermError and silently breaks your mail authentication. Paste a domain and get a single graded, shareable permalink that shows exactly which includes blew the lookup budget and how to fix it.

What the checker finds

  • Too many DNS lookups: the recursive RFC 7208 count across every include, a, mx and redirect. Over 10 is a PermError.
  • Which includes are the offenders: a per-mechanism breakdown showing how many lookups each include, a, mx or redirect consumes, biggest first.
  • Multiple SPF records: publishing more than one v=spf1 record is itself a PermError.
  • Broken includes: include targets that resolve but publish no SPF record of their own.
  • The all policy: whether the record ends in -all, ~all, ?all or the dangerous +all, or is missing all entirely.
  • Deprecated mechanisms: the ptr mechanism, which RFC 7208 tells you to stop using.

Why the ten lookup limit matters

RFC 7208 section 4.6.4 caps an SPF evaluation at ten DNS-lookup-consuming mechanisms. Each include, a, mx, ptr and exists counts as one, and an include expands recursively, so its own includes count too. A record that looks short can quietly fan out past ten once a provider adds ranges. When it does, receivers return PermError, and depending on your DMARC policy that can mean your legitimate mail is junked or rejected.

This checker does the recursive expansion for you and shows the exact total against the limit, so you can see which include to consolidate or remove. Need to dig into one area? Use the dedicated DNS Lookup, email diagnostics and Domain Health Report tools.