SPF and TXT record lookup
SPF lists the servers allowed to send mail as your domain. Enter a domain and the record is taken apart mechanism by mechanism, the DNS lookups it costs are counted against the limit of ten, and the DMARC policy and remaining TXT records are shown with it.
Reading an SPF record
SPF is an ordinary TXT record starting with v=spf1, followed by mechanisms. ip4 and ip6 authorise literal addresses, a and mx authorise the domain's own hosts, and include pulls in a provider's list. The record ends with all: '-all' rejects everything else, '~all' marks it as suspect, '?all' says nothing at all, and '+all' lets the entire internet send as you.
The ten-lookup limit
RFC 7208 allows an SPF evaluation at most ten DNS lookups. Every include, a, mx, ptr and exists spends one, and nested includes count too. Go over and the receiver returns permerror, which discards SPF entirely — exactly as if you had published nothing. This page walks the whole include chain and reports the total, so you see the problem before your mail starts landing in spam folders.
Two SPF records is a failure
If a domain publishes two v=spf1 records, receivers cannot choose between them and throw both away. It is the classic way mail breaks after adding a second sending service: the new provider's list belongs in an include inside the existing record, not in a record of its own.
Why DMARC is here too
SPF on its own guarantees little: it validates the envelope address, while the recipient sees the From header. DMARC ties the two together through a record at _dmarc.yourdomain with a policy of none, quarantine or reject. That is why the policy is shown next to SPF — while it reads p=none, your rules oblige receivers to do nothing.
Frequently asked questions
- What is the difference between '-all' and '~all'?
- '-all' (fail) asks receivers to reject mail from servers outside the list; '~all' (softfail) asks them to accept it but flag it. Starting with '~all' is safer, then moving to '-all' once DMARC reports confirm every legitimate sender is covered.
- How many DNS lookups does my SPF record cost?
- The tool counts them for you: it expands every include and redirect and reports the total out of ten. Anything above eight is worth trimming before the next mailing service tips it over.
- Does a domain that never sends mail need SPF?
- Yes. Publish 'v=spf1 -all' for it. That explicitly forbids sending as the domain and makes it far less useful for phishing.
- Mail passes SPF but still lands in spam. Why?
- SPF is one of three signals. A DKIM signature and an aligned DMARC policy matter as much, and a sending server also needs a correct PTR record. The domain checker covers all of them at once; the message tester does the same for one real message.