Does the SPF checker change my DNS?

No. It performs a live DNS lookup and reports what is currently published.

What does the SPF record found check mean?

It checks whether DNS returns a TXT record that starts with v=spf1 at your domain. That record tells receivers which servers are allowed to send mail for the domain.

Why do multiple SPF records cause an error?

SPF allows one SPF record per domain. If multiple SPF TXT records exist, receivers return a permanent error and SPF evaluation fails.

What makes an SPF record valid?

A valid SPF record starts with v=spf1, uses supported mechanisms and modifiers, separates each part with spaces, and contains valid domains, IP addresses, and CIDR ranges.

What is the 10 lookup limit?

SPF permits at most 10 DNS-querying terms during evaluation, including include, a, mx, ptr, exists and redirect and terms reached through nested includes. Exceeding the limit causes a permanent error; individual DNS packets are not the unit counted by this rule.

What is the 2 void lookup limit?

A void lookup is a DNS lookup that returns no useful answer. SPF allows only 2 void lookups because broken or missing include domains can slow evaluation and cause authentication errors.

What is an SPF include loop?

An include loop happens when SPF records reference each other in a cycle. Receivers keep following includes until the lookup limit is reached, then SPF fails with a permanent error.

Why does record length matter?

Long DNS answers may require TCP retries or depend on EDNS support. RFC 7208 gives sizing guidance that includes the DNS name and all TXT records in the answer, not a universal 450-byte validity limit for the SPF string alone. The checker record-length result is a compatibility signal.

Why should SPF end with ~all or -all?

~all and -all tell receivers that unlisted senders are not authorized. Without a clear all mechanism, receivers may not know how strongly to treat unauthorized mail.

Why is +all dangerous?

+all authorizes every server on the internet to send mail for your domain. That effectively disables SPF protection and makes spoofing easier.

Why does the checker flag PTR mechanisms?

The ptr mechanism is deprecated, slow, and unreliable because it depends on reverse DNS. Use explicit IP addresses or provider include mechanisms instead.

Why do duplicate includes matter?

Duplicate include mechanisms waste DNS lookups. Each duplicate still counts toward the 10 lookup limit, even if it points to the same provider.

What is an empty include?

An empty include points to a domain that has no SPF record. That can happen because of a typo, a changed provider domain, or broken DNS, and it can cause SPF to fail.

Why does the checker flag SPF macros?

Macros are valid SPF syntax and can be used intentionally by a provider. The checker flags them for closer review because their expansion depends on message context. A macro warning alone does not make a record invalid; follow your provider's documented setup before changing it.

Why does SPF need at least one IP or include?

A sending domain needs at least one authorized source, such as an include, IP address, a, mx, exists, or redirect. A record with no authorized source may be intentional for domains that never send email.

Why does the SPF checker also check DMARC?

SPF only identifies authorized sending servers. DMARC tells receivers what to do when authentication fails, so a domain should publish DMARC and move toward quarantine or reject.

Does this checker test a specific email message?

The standalone SPF checker validates DNS records. To see whether a real message passed SPF and whether SPF aligned with the From domain, use the email tester.

SPF checker

Bookmark

Use this free SPF checker tool to look up your domain's SPF record, check its syntax and count nested DNS lookups.

Check your SPF record is valid and correct

Live DNS lookup

Use the SPF checker tool to inspect your published record's syntax, multiple SPF records, nested DNS lookup limits and broken includes. For ongoing management, use Suped's hosted SPF and SPF flattening to keep records accurate and within lookup limits as providers change. For background, review the SPF lookup limit and SPF TXT formatting guide.

Get started

"This clarity allows us to take action faster whether it's adjusting content, fixing authentication, or addressing reputation issues. We've moved from reactive guesswork to proactive management."

John Porteous

Group IT Manager

Multiple SPF records: why the check fails and how to fix it

Separate v=spf1 records cause a permanent error. Combine legitimate senders into one record; multiple quoted strings within that TXT record are allowed.

Build one SPF record with your sending sources.

SPF record format and syntax examples

SPF starts with v=spf1 and separates mechanisms with spaces. Here, ip4 names a server, include references another policy, and ~all marks other senders as soft fail.

v=spf1 ip4:192.0.2.10 include:_spf.example.net ~all

Documentation-only placeholders: replace the IP and include domain with your authorized senders.

Create an SPF record for your sending domain.

SPF includes and the 10-DNS-lookup limit

Nested includes count toward SPF's limit of 10 DNS-querying terms, not individual DNS packets. Investigate obsolete providers and broken includes before removing active senders.

Understand SPF lookup limits and possible fixes.

SPF syntax and DNS checks in one report

The SPF checker reads the TXT record published for a domain; it does not accept pasted records or test a particular sending IP. Check the return-path domain your provider uses, which can differ from the visible From domain. Use the email tester to verify the SPF result and alignment of a real message.

SPF record

example.com

TXTv=spf1 include:_spf.google.com ~all

Live SPF DNS lookup

Check the exact SPF TXT record receivers evaluate for your domain.

DNS lookups

7 / 10

Void lookups1 / 2

Lookup limit checks

See DNS and void lookup counts before receivers hit SPF permanent errors.

include:_spf.google.com

ip4:192.0.2.24

Published sending sources

Inspect the IP addresses, provider includes and other mechanisms published in the SPF record.

+all~all-all

Safer all mechanism

Flag +all, neutral endings, and weak endings that leave unauthorized mail exposed.

No loops

No duplicates

No empty includes

Include hygiene

Find duplicate, empty, and looping includes that waste lookups or break evaluation.

DMARC

p=quarantine

SPF failures protected

Related DMARC policy

Check the published DMARC policy alongside SPF; real-message alignment needs a separate email test.

SPF checker FAQs

Answers to common questions about validating an SPF record, reading the results, and deciding what to fix next.

Here's why customers love Suped for DMARC monitoring

Read customer stories

How MONEYME proactively strengthens domain security and unlocks higher email engagement with Suped

See how MONEYME uses Suped

How cybersecurity specialist Jam Cyber delivers scalable DMARC protection with Suped

See how Jam Cyber uses Suped

How Vision Australia maintains full DMARC enforcement across a large domain portfolio with Suped

See how Vision Australia uses Suped

How The POP Team turns domain checks and DMARC visibility into client ready delivery work

See how The POP Team uses Suped

How DigiBean simplified DMARC monitoring and improved email security for their MSP clients

See how DigiBean uses Suped

How Alliance Group moved from reactive guesswork to proactive email management with Suped

See how Alliance Group uses Suped

Start monitoring your DMARC reports today

What you'll get with Suped

Real-time DMARC report monitoring and analysis

Automated alerts for authentication failures

Clear recommendations to improve email deliverability

Protection against phishing and domain spoofing

Get started - free