Free tool, no signup
Free SPF checker
Enter a domain to see its SPF record, how many of the 10 allowed DNS lookups it uses, and what to fix. We check DKIM, DMARC and MX at the same time.
Your report will show:
What SPF does
SPF lists the servers allowed to send mail for your domain. When a message arrives, the receiver looks up the SPF record of the envelope sender’s domain and checks that the sending server is on the list.
The record is a single TXT record that starts with v=spf1, lists your senders, and ends with a rule for everyone else, usually ~all or -all.
The 10 DNS lookup limit
This is the most common way an SPF record breaks without anyone noticing. RFC 7208 caps SPF at 10 DNS lookups. Each of these costs one: include, a, mx, ptr, exists and redirect. Includes inside includes count too, so a record with four includes can need more than ten lookups. ip4, ip6 and all cost nothing.
If the checker shows more than 10, reduce it:
- Remove services you no longer use.
- Move tools you don’t control, such as bulk or cold email senders, to a subdomain with its own SPF record.
- Replace an include with
ip4/ip6ranges only when the vendor publishes stable addresses. Microsoft advises against doing this for Microsoft 365.
Common SPF records
| You send from | Documented record |
|---|---|
| Google Workspace only | v=spf1 include:_spf.google.com ~all |
| Microsoft 365 only | v=spf1 include:spf.protection.outlook.com -all |
| A domain that never sends mail | v=spf1 -all |
Errors the checker catches
- No record: receivers cannot tell your servers from anyone else’s.
- Two records: SPF returns a permanent error. Merge them.
- More than 10 lookups: permanent error, even if the syntax is perfect.
- An include with no SPF record behind it: permanent error.
- +all: lets any server send as you.
- ptr: RFC 7208 says it should not be used.
Questions
Frequently asked questions
What is an SPF record?
An SPF record is a TXT record on your domain that starts with v=spf1 and lists the servers and services allowed to send mail for it, for example include:_spf.google.com for Google Workspace.
How many SPF records can a domain have?
One. Two or more v=spf1 records make SPF return a permanent error, so receivers treat your mail as unauthenticated. Merge every service into a single record.
What is the SPF 10 lookup limit?
Receivers stop after 10 DNS lookups. include, a, mx, ptr, exists and redirect each cost one, and so does every include inside an include. Going over the limit makes SPF fail with a permanent error, even though the record looks fine.
Should I use ~all or -all?
Both tell receivers that unlisted servers are not allowed. Microsoft recommends -all for Microsoft 365 domains that also use DKIM and DMARC; Google documents ~all. Never use +all, which allows every server on the internet.
Is SPF enough to protect my domain?
No. SPF checks the envelope sender (Return-Path), not the From address people see. Add DKIM and DMARC: Gmail, Yahoo and Outlook.com require all three from bulk senders.
Official sources
What this page is based on
- IETF RFC 7208: Sender Policy Framework
- Google Workspace: Set up SPF
- Microsoft: Set up SPF for your Microsoft 365 domain
- Google: Email sender guidelines
Checked October 27, 2026. Mailbox providers change their rules; the linked pages are authoritative. This tool reads public DNS only and is not a guarantee of inbox placement.
Your domain is ready. Who should you email?
Looply finds people showing buying signals, scores them against your ideal customer profile and sends personalized cold email from your own connected inboxes.