SPF Checker

What an SPF check actually tells you

SPF is a TXT record on your domain listing who may send mail as you. A receiver looks it up, compares it to the server that just connected, and gets pass, fail, softfail or an error. This tool fetches the record, resolves every include, and counts the DNS lookups it costs - because the limit on those is what breaks most records that otherwise look fine.

What is the ten-lookup limit?

SPF evaluation is capped at ten DNS lookups. Each include, a, mx, ptr and exists mechanism costs one, and includes nest - a provider you add may pull in three more without telling you. Exceeding the cap is a PermError, and a PermError is treated as no SPF record at all, so the check that was passing yesterday silently stops counting.

Should the record end in -all or ~all?

-all means a message from an unlisted server should be rejected; ~all means it should be accepted but marked. Start at ~all while you confirm every legitimate sender is listed, then move to -all. Leaving it at ~all forever means you have published a list nobody is required to honour.

SPF passes but mail still fails DMARC. Why?

DMARC requires alignment, not just a pass. The domain SPF authenticated must match the domain in the visible From header. If you send through a provider that uses its own return-path, SPF passes against that provider and aligns with nothing, so DMARC fails. A DKIM signature published under your own domain is the usual fix.

Can I have two SPF records?

No. A domain with two TXT records starting v=spf1 is a PermError by specification, and receivers do not merge them. Everything has to go in one record, which is also why the lookup limit bites - you cannot split your way out of it.