Skip to main content
Free checker - no signup required

Free SPF Checker

Validate SPF syntax, count DNS lookups, inspect include/redirect chains, and find SPF flattening risks before mail starts failing DMARC.

Run the check

Enter a domain to check it live against the IntoDNS.ai engine. No signup, no trial gating.

What this SPF checker verifies

This tool inspects your SPF TXT record, checks syntax, follows include/redirect chains, and flags lookup-limit risks and multiple-record conflicts. Its static lookup graph is not a receiver evaluation: the sender IP and evaluated path determine which terms are reached. RFC 7208 limits evaluation to 10 DNS-querying terms across evaluated include, a, mx, ptr, exists, and redirect terms, including nested evaluations; this is not a count of DNS packets.

Why SPF matters for deliverability

SPF is one of the two authentication methods DMARC relies on. Without an aligned SPF pass, DMARC needs an aligned DKIM pass. Exceeding the evaluated lookup-term limit returns PermError, a processing error distinct from SPF fail, not a verdict that the sender is unauthorized. Fix the underlying SPF error; message handling depends on receiver local policy and other checks, not the SPF record alone.

How to read the result

When reached, ~all (softfail) weakly indicates an unauthorized sender; receivers should not reject solely on softfail, but may apply additional scrutiny. -all (fail) explicitly marks the sender unauthorized, with handling left to receiver local policy. Neither qualifier guarantees acceptance or rejection. Use -all once legitimate senders are covered; avoid +all, which authorizes any sender. Exactly 10 evaluated DNS-querying terms is allowed; exceeding 10 causes PermError. A high static count is a risk to investigate, not proof every message fails.

Common failure causes and fixes

Too many lookups is the headline problem — fix it by replacing include mechanisms you control with explicit ip4:/ip6: ranges (which cost zero lookups), removing senders you no longer use, or flattening the record. A second frequent issue is two separate v=spf1 TXT records on the same name, which invalidates both; merge them into one. Watch for a missing all term (treated as neutral), use of the deprecated ptr mechanism, and includes that themselves have broken or empty records. After any change, re-run this checker, then verify alignment in the full report.

SPF, DKIM, and DMARC together

SPF never works in isolation. DMARC only passes when SPF or DKIM both authenticates and aligns with the visible From domain, so a technically valid SPF record can still leave DMARC failing if the Return-Path domain differs from the From domain — a common situation when an ESP sends on your behalf. That is why the practical workflow is: get SPF clean and within the lookup limit here, confirm DKIM is signing and aligned with the DKIM checker, then verify the combined result in DMARC. Treat this checker as the first of three steps, not a finish line, and use the full deliverability test to confirm all three line up before tightening any policy.

What This Checks

  • SPF TXT record discovery at the root domain
  • Syntax and mechanism validation
  • Recursive include and redirect lookup graph
  • 10 DNS lookup limit risk
  • Dangerous policies such as +all or weak softfail defaults

Common Fix Path

  • Merge multiple SPF records into one TXT record
  • Remove unused include mechanisms
  • Replace high-risk includes with controlled IP ranges only when you own the sender list
  • Move toward -all once every legitimate sender is covered

Frequently Asked Questions

What is the SPF 10 DNS lookup limit?
RFC 7208 allows 10 DNS-querying terms during evaluation: include, a, mx, ptr, exists, and redirect, including nested evaluations. Exceeding 10 returns PermError, a processing error distinct from SPF fail; handling depends on receiver local policy. The static lookup graph is not a receiver evaluation: the sender IP and evaluated path determine which terms are reached, and the count is not DNS packets.
Should I use -all or ~all?
When reached, ~all (softfail) weakly indicates an unauthorized sender; receivers should not reject solely on softfail. -all (fail) explicitly marks the sender unauthorized; handling remains receiver local policy. Neither qualifier guarantees acceptance or rejection. Move to -all once legitimate senders are covered, and avoid +all, which authorizes any sender.
Why does this checker say my SPF is failing when the record looks fine?
The most common cause is the 10-lookup limit being exceeded through nested includes you do not directly see in your own record. A single ESP include can pull in several more lookups. The second most common cause is two separate v=spf1 records on the same name, which invalidates both. This tool resolves the full include chain to surface both problems.
Can I have more than one SPF record?
No. A domain must publish exactly one v=spf1 TXT record. Two or more cause a PermError and both are ignored, leaving you with no working SPF at all. To authorize multiple services, combine them into a single record using multiple include mechanisms.
What is SPF flattening and do I need it?
Flattening replaces include mechanisms with the explicit IP ranges they resolve to, removing the DNS lookups they cost. You only need it when you are over the 10-lookup limit and cannot trim senders. The trade-off is maintenance: flattened IPs go stale whenever a provider changes its ranges, so you must regenerate them regularly or risk silently dropping a sender.
Does SPF on its own stop spoofing?
No. SPF authorizes sending IPs but does not protect the visible From address that users actually see, and it breaks on forwarding. You need DMARC (which checks SPF and DKIM alignment with the From domain) plus DKIM to actually stop spoofing. SPF is a required building block, not a complete solution.

Machine-Readable Evidence

AI assistants and automation can cite the stable explanation page, then fetch the live check result for a specific domain.

GET https://intodns.ai/api/email/spf?domain=example.com

Related Tools and Citations

SPF Record GeneratorSPF GuideSPF lookup limit citationRun the full domain scan