SPF checker and lookup counter

What SPF is

SPF is a DNS record listing the servers allowed to send mail for your domain. A receiving server looks it up, checks whether the message came from one of them, and uses the answer as one half of the authentication that DMARC then acts on.

v=spf1 include:_spf.google.com include:sendgrid.net ~all

The ten lookup limit, which is the real reason this page exists

SPF is allowed ten DNS lookups, and this is the failure worth knowing about because it is invisible until it isn't.

Every include:, a, mx, ptr, exists and redirect in your record costs a lookup — and so does every one of those inside the records they point at. A record with four includes can easily cost twelve lookups, because each provider's include expands into two or three of their own.

Past ten, a receiving server stops evaluating and returns permerror. Under DMARC, permerror is a failure. Your mail starts failing authentication and your SPF record still reads perfectly sensibly to whoever wrote it, because the problem is not in the record — it is in the total after everything expands.

The lookup count is the number this checker leads with for that reason. Eight of ten is worth knowing about before you add the next tool.

How a record goes over

It is almost never a single change. It is four years of adding one include: per new service — a mailing list tool, an invoicing product, a CRM, a helpdesk — each of which is a reasonable addition on its own and none of which is ever removed when the service is dropped.

The usual fixes:

• Remove includes for services you have stopped using. This is nearly always enough, and it costs nothing.
• Replace an include: with the ip4:/ip6: addresses behind it, which cost no lookups. This is faster but goes stale when the provider renumbers.
• Use an SPF flattening service, which does the same thing and keeps it updated.

~all and -all

The last mechanism says what to do with a sender not on the list. ~all is a soft fail — treat it as suspicious. -all is a hard fail — reject it. ?all is neutral and means the record has no teeth at all.

~all is the right default while you are still finding out who sends as you. -all is where you want to end up, and it is safe to get there once DMARC aggregate reports have been quiet for a few weeks.

What this checker reads

It queries the domain's SPF TXT record, expands the mechanisms to count DNS lookups the way a receiving server would, and reports the record verbatim. Public DNS only — nothing is sent, no account is needed, and the domain you type is not stored.