Free SPF record checker
Look up a domain's SPF record, count its DNS lookups against the limit of 10, and see every include behind it. The checker runs in your browser and queries public DNS.
Set up your sending domain in Loops
Sending from your own domain? Loops lists your SPF, DKIM and MX records and checks them.
How to check an SPF record
Enter the domain you send from, such as yourdomain.com, and click Check SPF. The checker reads the TXT record that starts with v=spf1, then follows every include, a, mx, ptr, exists and redirect term the way a receiving server would.
The lookup count is the number to watch. SPF allows 10 DNS lookups per check, and lookups inside nested includes count too. A receiver that goes past 10 stops with a permanent error, so SPF fails for every message. The include tree shows where each lookup comes from.
Sending through Loops? Loops publishes SPF at envelope.yourdomain.com, not at your root domain, so it adds nothing to your root record’s count. If the domain you enter has no SPF record, the checker reads the envelope subdomain instead.
How to fix common SPF errors
Too many DNS lookups. Remove includes for services you no longer send from. Replacing a provider’s include with its IP ranges also saves lookups, but then you have to update the record whenever the provider changes its addresses.
More than one SPF record. A hostname can publish only one TXT record that starts with v=spf1. Merge them into one: keep a single v=spf1, combine the include and ip4 terms, and end with one all.
Void lookups. A term that points to a name with no records, often an include for a service you dropped, is a void lookup. Receivers can fail SPF after two, so delete those terms.
+all or ?all. +all lets any server pass SPF for your domain, and ?all makes no claim either way. End the record with ~all or -all.
Syntax errors. The usual ones are include= in place of include:, a mistyped IP range, and terms after all, which receivers never read.
For the full syntax and more fixes, read the SPF record guide.
SPF, DKIM and DMARC
SPF checks the envelope sender (the Return-Path address), not the From address your readers see. DMARC connects the two: it passes when SPF or DKIM passes for a domain aligned with the From domain.
To check DKIM, DMARC and MX in one pass, use the email DNS checker. To write a DMARC policy, use the DMARC record generator. Both are on the free email tools page.
FAQ
What is the SPF lookup limit?
An SPF check can make at most 10 DNS lookups. Each include, a, mx, ptr, exists and redirect counts as one, and so does every lookup inside an included record. Past 10, receivers return a permanent error and SPF fails.
Can a domain have two SPF records?
No. If a hostname publishes more than one TXT record that starts with v=spf1, receivers return a permanent error and SPF fails. Merge them into one record with a single all at the end.
What is a void lookup?
A void lookup is a DNS query from your SPF record that returns no records, such as an include for a domain that no longer exists. RFC 7208 recommends a limit of two, and receivers that enforce it fail SPF after that.
Should I use ~all or -all?
Both work once every server that sends for you is listed. ~all (soft fail) asks receivers to accept mail from other servers but mark it, and -all (fail) asks them to reject it. Some receivers act on -all before they check DMARC, so domains with a DMARC policy often use ~all and let DMARC decide.
Where does Loops publish SPF?
On the envelope subdomain shown in your domain settings, such as envelope.yourdomain.com. It’s separate from any SPF record at your root domain, so it adds no lookups there. If the domain you enter has no SPF record, this checker reads envelope.yourdomain.com instead.
What's next
Related reading and free tools.