Patchkit

Free tool

SPF Checker

Follow every include in a domain's SPF record, count DNS lookups against the limit of 10, and see exactly what breaks it.

How SPF works

SPF is a single TXT record that lists the servers allowed to send mail for your domain. Receivers check the server that delivered a message against that list. Each include: pulls in another company's list, which is how Google Workspace, Microsoft 365 or your newsletter tool get authorized.

Staying under 10 lookups

Every include can contain more includes, and all of them count. Common fixes, in order of preference:

  1. Remove includes for services you no longer use.
  2. Move marketing or transactional senders to a subdomain with its own SPF record.
  3. Replace an include with the provider's fixed IP ranges, only if they publish and maintain them.

Build a clean record with the SPF generator, then check it here again after publishing.

Frequently asked questions

+What is the SPF 10 lookup limit?

Receivers stop evaluating SPF after 10 DNS lookups caused by include, a, mx, ptr, exists and redirect. Lookups inside included records count too. Going over the limit makes SPF fail for every message, even from servers you listed.

+Can I have two SPF records?

No. A domain must publish exactly one TXT record starting with v=spf1. With two, receivers return a permanent error and SPF fails. Merge the mechanisms into a single record.

+Should my SPF record end with -all or ~all?

Both are fine once DMARC is in place, because DMARC decides the final action. ~all (soft fail) is the safer choice while you're still discovering senders. Never use +all, which authorizes every server on the internet.

+Why does SPF pass but DMARC still fail?

Many email services send with their own return-path domain, so SPF passes for their domain, not yours. DMARC needs alignment with your From domain. For those services, DMARC passes through DKIM instead.