SPF Checker

About the spf checker

SPF (Sender Policy Framework, RFC 7208) is a DNS TXT record that lists which mail servers are authorized to send email claiming to be from your domain. A receiving server checks the sending IP against this list during the SMTP conversation; a match is a pass, and no match is a fail or softfail depending on the qualifier at the end of the record.

This tool parses the record, follows every include, redirect and a/mx mechanism it references, and renders the whole chain as a tree so you can see exactly which providers are authorized and how deeply nested each include goes. It also counts every DNS-querying mechanism against the ten-lookup ceiling that RFC 7208 imposes. Exceeding ten lookups does not make SPF stricter; it makes SPF fail entirely with a permanent error (permerror), which most receivers treat the same as no SPF record at all. Third-party includes are the usual culprit, since each one can itself contain further includes that count toward the same limit.

The record must end in exactly one all mechanism. -all tells receivers to reject mail from unlisted senders outright, ~all marks it as suspicious but still deliverable (softfail), and the record having no all mechanism, or more than one v=spf1 TXT record on the domain, is itself an error that most receivers will not honor. Getting this last mechanism right matters more than any single include, since it is the one setting that decides what receivers actually do with mail from senders the record does not explicitly authorize.

Common questions

What is the 10 DNS lookup limit?

RFC 7208 allows at most 10 DNS-querying mechanisms per evaluation: include, a, mx, ptr, exists and redirect all count. Exceeding it causes a permanent error, and most receivers then treat the domain as having no SPF at all.

What is the difference between ~all and -all?

-all tells receivers to reject mail from senders not listed in the record. ~all only marks it as suspicious, a softfail, and receivers usually still deliver it, often to spam.

Can I have two SPF records?

No. Multiple v=spf1 TXT records on the same domain are explicitly an error under RFC 7208. Merge every sender into a single record.

Do subdomains inherit the root domain's SPF record?

No. SPF is evaluated per exact hostname used in the return-path domain, so a subdomain that sends mail needs its own SPF record unless it redirects to the parent.