✅ SPF Record Validator

What This SPF Checker Validates

Enter a domain and the tool fetches its published SPF record, then runs the same checks a receiving mail server would:

• Syntax — the record starts with v=spf1 and every mechanism is well-formed.
• Single record — exactly one SPF record exists (publishing two is an error that breaks SPF).
• DNS lookup count — stays within the 10-lookup limit, shown as a full include tree.
• Policy strength — whether it ends in -all, ~all, or the weaker ?all/+all.
• Risky mechanisms — flags deprecated constructs like ptr.

SPF DNS Lookup Limits

SPF has a limit of 10 DNS lookups to prevent denial-of-service attacks. Each include:, a, mx, ptr, exists, and redirect mechanism counts as one lookup. Nested includes count towards the total.

If you exceed 10 lookups, receivers return a PermError and stop trusting your record — legitimate email can then fail SPF and land in spam.

Common SPF Errors (and How to Fix Them)

• Too many DNS lookups (PermError) — more than 10. Remove unused senders or flatten includes to ip4:/ip6: ranges.
• Multiple SPF records — a domain may have only one. Merge every sender into a single v=spf1 record.
• Missing -all (or using +all) — the record authorizes everyone and provides no spoofing protection. End with ~all or -all.
• Using ptr — deprecated, slow, and unreliable. Replace it with ip4:/ip6: or an include.
• Typos in include domains — one wrong character silently breaks authentication. See why one typo breaks email.

Need to build a clean record from scratch? Use the SPF record generator.

Frequently Asked Questions

What does an SPF checker do?

It looks up your domain's published SPF record and validates it: correct syntax, a single record, the number of DNS lookups it triggers, and how strict its policy is. The result tells you whether receiving servers will actually trust mail from your authorized senders.

What is a valid SPF record?

A single DNS TXT record that begins with v=spf1, lists your authorized senders (via include, ip4, a, mx, etc.), stays within 10 DNS lookups, and ends with an all policy — ideally -all.

Why is my SPF record failing or invalid?

The usual causes are exceeding the 10-lookup limit, publishing two SPF records, a typo in an include domain, or a missing all policy. This checker pinpoints which one applies to your record.

What causes an SPF PermError?

Most often, too many DNS lookups (more than 10). Because nested includes count too, a few third-party senders can quietly push you over. Reduce includes or flatten them to IP ranges to get back under the limit.