Should I use -all or ~all?

Either is fine once DMARC is enforcing. ~all is the common choice because it avoids rejecting forwarded mail on SPF alone, while DMARC decides the final outcome.

Why does my record show more lookups than I can see?

Includes are followed. A single include can point to a record with several more, and every one of them counts towards the limit of 10.

Does SPF protect the From address people see?

Not by itself. SPF checks the envelope sender, which users never see. DMARC is what ties the result to the visible From address.

Does a passing SPF record mean my mail reaches the inbox?

No. It is one authentication signal. Reputation, content and your bounce rate matter too, which is why sending to verified addresses still counts.

Free tool

SPF record checker

Enter a domain to see its SPF record, what each part does and how many DNS lookups it really uses once every include is followed. Going over 10 breaks SPF, and nothing warns you when it happens.

What SPF does

SPF is a DNS record listing the servers allowed to send mail for your domain. Receivers compare the connecting server against it. On its own it only checks the envelope sender, so it is most useful as one of the two signals DMARC can rely on.

What this checker looks for

It reads the live record and flags the mistakes that actually break delivery or leave a domain open to spoofing.

More than one SPF record, which is a permanent error under RFC 7208.
More than 10 DNS lookups once includes and redirects are followed, also a permanent error.
+all, which authorises every server on the internet to send as you.
A missing all mechanism, or ?all, which offers almost no protection.
The deprecated ptr mechanism.

Fixing too many DNS lookups

Each include, a, mx, ptr, exists and redirect counts as one lookup, and includes count whatever they contain too, so one marketing tool can use several. Remove services you no longer use first. If you are still over, move a sending service to its own subdomain, which gets its own SPF record and its own limit of 10.

FAQ

Frequently asked questions.

Verify your list with 250 free checks Read the API docs

Check your first address in the next minute.

250 free checks every month, forever. Upgrade when you outgrow them.

Get started free Read the API docs

What this checker looks for

It reads the live record and flags the mistakes that actually break delivery or leave a domain open to spoofing.

More than one SPF record, which is a permanent error under RFC 7208.

More than 10 DNS lookups once includes and redirects are followed, also a permanent error.

+all, which authorises every server on the internet to send as you.

A missing all mechanism, or ?all, which offers almost no protection.

The deprecated ptr mechanism.

Fixing too many DNS lookups