Tools
SPF record checker.
Look up an SPF record, expand its includes, and check it against the 10 DNS lookup limit.
How to read your results
The lookup count is what matters most. SPF allows 10 DNS lookups per evaluation; each include, a, mx, ptr, and exists counts. Go over and receivers return permerror, so SPF fails even for legitimate mail.
Over the limit? Drop includes you no longer use, or replace nested ones with their underlying ip4 and ip6 ranges, which do not count. Hosted SPF flattening keeps that single include up to date automatically.
The ending tells receivers what to do with senders not listed: -all says reject, ~all says treat as suspicious. Use -all once every legitimate sender is covered.
SPF is only half the picture. SPF fails but DMARC passes explains how alignment works, and the DMARC checker shows the full authentication setup.
Frequently asked questions
- What is the SPF 10-lookup limit?
- SPF allows a maximum of 10 DNS lookups when a record is evaluated. Each include, a, mx, ptr, and exists mechanism counts. Go over and receivers return a permerror, which means SPF fails even for legitimate mail.
- How do I fix "too many DNS lookups" (PermError)?
- Remove includes you no longer use, replace nested includes with their underlying ip4 and ip6 ranges, or use a hosted SPF flattening service that keeps a single include up to date for you. ip4 and ip6 mechanisms do not count toward the limit.
- How do I check my SPF record?
- Enter your domain above. dmarcula looks up your SPF record, recursively expands every include, and shows the total DNS lookup count against the limit of 10.
- What does -all versus ~all mean?
- The -all (hard fail) tells receivers to reject mail from senders not listed. The ~all (soft fail) marks it suspicious but usually still delivers. Use -all once you are confident every legitimate sender is included.
- Can I have more than one SPF record?
- No. A domain must have exactly one SPF record. Two or more cause a permerror, so merge them into a single record.
This check is a snapshot. dmarcula watches your domain around the clock, reads the DMARC reports for you, and emails you when something changes. Free, no credit card.