Deliverability
SPF Checker
Expands an SPF record include by include and counts DNS lookups against the limit of 10.
- Runs on our server
- 2 units per run
- You enter
- The sending domain.
- You get
- The published record, a lookup meter, the final policy, warnings and the full expansion tree.
- A good result
- One SPF record, at most 10 lookups, ending in
~allor-all.
On this page
#What it is for
An SPF record that needs more than 10 DNS lookups fails with permerror at the receiver, which counts as no SPF at all. Use this tool when a domain adds another sending service or when headers show an SPF error.
#What you enter
The sending domain, such as example.com. Not the tracking subdomain and not a URL.
#How it works
It reads the SPF record and follows every include and redirect (up to 6 levels deep, with loop detection), counting what costs a lookup:
| Counts towards 10 | Does not count |
|---|---|
include, redirect=, a, mx, exists, ptr | ip4, ip6, all, exp= |
#Reading the results
- Lookup meter: green, amber from 8, red above 10.
- Final policy:
-allhard fail (strict),~allsoft fail (usual),?allneutral (weak),+alllets anyone send (dangerous), none (incomplete). - Warnings: no record, more than one record,
+all,ptr, unknown terms, a missingall, depth limit or loop. - Tree: every include with its own lookups, to see which service costs the most.
Over 10 is a failure even if everything else is right. Remove services the domain no longer uses, or replace an include with its ip4 ranges where the provider allows it.
#Example
v=spf1 include:_spf.google.com include:spf.protection.outlook.com include:_spf.ecomailapp.cz ~allGoogle and Microsoft includes each pull in further includes; together with Ecomail this record sits close to the limit, which the meter makes visible.
#Limits and gotchas
- Two SPF records on one domain is itself an error; merge them into one.
- Each lookup waits up to 4 seconds; a slow provider can cut the tree short.
- Whether Ecomail is included at all is shown by the DNS Checker; what receivers actually saw is in the Email Header Analyzer.