SPF record checker

SPF (Sender Policy Framework) is a DNS record that lists the servers allowed to send email for your domain. Receiving servers check it, and mail from a server that is not listed can be marked as spam or rejected.

It only takes one TXT record, but it is easy to get wrong: a second record, a typo, or one include too many can silently break it.

Evaluating an SPF record is allowed to trigger at most ten DNS lookups: each include, a, mx, ptr, exists and redirect counts, including those inside the records you include. Go over and receivers return a permanent error, which many treat as a failure.

This is the most common SPF problem for domains that use several services (a marketing platform, a CRM, a helpdesk, Google Workspace). The checker follows every include and shows you the count. If you are over, remove services you no longer use or replace includes with the ip4 and ip6 ranges they publish.

The final term says what to do with mail from servers that are not listed. -all rejects it, ~all marks it as a soft fail, and ?all does nothing useful. +all, or a bare all, allows everyone and defeats the purpose. Most domains start with ~all and move to -all once they are sure every legitimate sender is listed.