Free SPF record check
This free SPF checker counts every DNS lookup in your record, shows which service is eating them, and tells you exactly what to cut. Ten lookups is the hard limit, and one over breaks SPF for all your email.
Example result for yourcompany.com
This record needs 12 DNS lookups. Inboxes stop at 10, so SPF fails and your email can land in spam, even when it comes from a service you’ve listed.
How to fix it
Remove services you no longer send from. Each include costs at least one lookup: SendGrid uses 2, Salesforce uses 2. Delete any you have stopped using.
Drop a and mx unless those servers send email. Your website and inbox servers rarely send mail themselves. Removing a and mx saves 2 lookups.
Still over? Flatten the record. Flattening swaps includes for the addresses behind them, which cost no lookups. Use a service that updates it for you, because providers change their addresses.
Sponsored
EasyDMARC
Don't want to manage it by hand? EasyDMARC flattens SPF for you and keeps it up to date.
Your SPF record
v=spf1 a mx include:_spf.google.com include:spf.protection.outlook.com include:sendgrid.net include:servers.mcsv.net include:mail.zendesk.com include:spf.mandrillapp.com include:_spf.salesforce.com include:mktomail.com ~all
DNS lookups used
12 of 10
What uses your lookups
| Part of the record | Service | Lookups |
|---|---|---|
a | Your website’s server | 1 |
mx | Your inbox servers (Google Workspace) | 1 |
include:_spf.google.com | Google Workspace | 1 |
include:spf.protection.outlook.com | Microsoft 365 | 1 |
include:sendgrid.net | SendGrid↳ ab.sendgrid.net | 2 |
include:servers.mcsv.net | Mailchimp | 1 |
include:mail.zendesk.com | Zendesk | 1 |
include:spf.mandrillapp.com | Mandrill | 1 |
include:_spf.salesforce.com | Salesforce↳ one more include inside | 2 |
include:mktomail.com | Marketo | 1 |
~all | Everyone else: soft fail | Free |
| Total | 12 | |
Checks
SPF is one TXT record that lists every service allowed to send email for your domain. Inboxes check it on every message, and the ending tells them what to do with everyone else.
-all
Mail from anyone not listed fails outright. Use it once you are sure every sender is in the record.
~all
Mail from senders you haven’t listed is treated with suspicion. The safe, common choice, especially alongside DMARC.
+all and ?all
+all lets anyone in the world send as you, and ?all tells inboxes nothing. Neither protects your domain.
Every part that makes an inbox look something up uses one of your 10, including the includes nested inside other includes. One service can use several.
include:another service's SPF record, plus every include inside it
athe address of your website's server
mxthe addresses of your inbox servers
redirect=hands the whole check to another domain
exists, ptrrarely used; ptr is outdated and best removed
ip4:a fixed IPv4 address or range
ip6:a fixed IPv6 address or range
~all, -allthe ending rule
That is why flattening works: it swaps includes for ip4 and ip6 addresses, which cost nothing.
It reads the SPF record in your domain’s DNS, follows every include, counts the DNS lookups against the limit of 10 and checks the ending. Then it tells you which service uses each lookup and what to change.
The SPF standard caps lookups so one email can’t make inboxes chase endless records. Go over 10 and the check fails, so receiving servers treat your mail as unverified.
No. With two SPF records every check fails. Merge everything into one record and delete the other. The checker writes the merged record for you.
Use ~all while you are still finding every sender. Once DMARC is in place it does the enforcing, so ~all is fine long term. Use -all when you are certain the list is complete.
Step-by-step fix guides: SPF record syntax, with examples · SPF record for Google Workspace · SPF record for Microsoft 365 · How to fix SPF “too many DNS lookups” · Multiple SPF records · SPF softfail
