What is the SPF 10 lookup limit?

Receivers stop evaluating an SPF record after 10 DNS lookups, counting every include, a, mx, ptr, exists and redirect, including those inside included records. Past 10, SPF returns a permanent error and fails for every message (RFC 7208 section 4.6.4).

Can a domain have two SPF records?

No. With more than one TXT record starting with v=spf1, receivers return a permanent error. Merge all mechanisms into a single record that ends with one all term.

Does this checker send an email?

No. It reads the public DNS records of the domain you enter, through a DNS-over-HTTPS resolver, and explains them in your browser. Nothing is sent to the domain.

SPF record checker

Example result for example.com

TXT at example.com

v=spf1 include:_spf.example.net ip4:192.0.2.0/24 +all

+all lets any server send as you.
It means “every server on the internet is allowed”, so SPF passes for spammers too and protects nothing.
Fix: Change it to ~all or -all after listing your real senders.
1 of 10 DNS lookups used.
Includes inside included records count too; this total covers them.

Enter a domain to see its SPF record, every record it includes and the total number of DNS lookups. Each problem is explained in plain English with the change that fixes it. The check reads public DNS only and sends no email.

What SPF does

SPF (Sender Policy Framework, RFC 7208) lets a domain publish which servers may send its mail. The receiving server looks up a TXT record that starts with v=spf1 on the domain in the message's envelope sender (the Return-Path) and compares the connecting server's IP address with the list. The answer is one of pass, fail, soft fail, neutral, none, or an error.

SPF alone does not protect the From address people see: that is DMARC's job, which uses an SPF or DKIM pass only when the checked domain matches the From domain. Check DMARC with our DMARC checker.

How to read a record

A record is a list of terms evaluated left to right; the first one that matches decides the result.

Term	Meaning	DNS lookup?
`ip4:192.0.2.0/24`, `ip6:2001:db8::/32`	These addresses may send	No
`include:_spf.example.net`	Whatever that domain's SPF record allows	Yes
`a`, `mx`	The domain's own A/AAAA or MX hosts	Yes
`exists:`, `ptr`	Advanced and rarely needed (`ptr` should not be used)	Yes
`redirect=example.net`	Use another domain's record instead	Yes
`-all`, `~all`, `?all`	Everything else fails, soft-fails or is neutral	No

Each term can start with a qualifier: + pass (the default), - fail, ~ soft fail, ? neutral.

The problems this checker finds

More than 10 DNS lookups. Every include, a, mx, ptr, exists and redirect costs one lookup, counted across all included records. Past 10, receivers stop with a permanent error and SPF fails for every message (RFC 7208 §4.6.4). Fix: remove services you no longer use, replace a and mx with the ip4:/ip6: ranges they stand for, or send bulk mail from a subdomain with its own record.
More than one SPF record. A domain may publish only one; two or more make every check a permanent error (§4.5). Fix: merge them into one record with one all at the end.
+all or a bare all. It allows every server on the internet, so SPF passes for anyone. Fix: list your real senders and end with ~all or -all.
?all or no all. Unlisted servers get a neutral result, which tells receivers nothing.
Includes that do not exist. An include: that points at a domain without an SPF record is a permanent error (§5.2); often a provider changed its include name. More than two lookups that return nothing ("void lookups") may also stop the check.
Syntax errors. Unknown terms such as ipv4: or an invalid address range make the whole record fail (§5).
Terms after all never match (evaluation stops at all), and redirect= is ignored when all is present (§6.1).
ptr. Slow and unreliable; RFC 7208 §5.5 says it should not be used.

Soft fail or fail?

~all (soft fail) and -all (fail) both tell receivers that unlisted servers are not yours. Most large mailbox providers weigh them the same way and leave the final decision to DMARC, so ~all is the usual choice while you confirm that every sender is listed. Use -all when you are sure, for example on a domain that sends no mail at all: v=spf1 -all.

Requirements of the large mailbox providers

Since 2024 Gmail and Yahoo require SPF or DKIM on all mail, and SPF, DKIM and DMARC from bulk senders; Outlook.com has applied the same rules to high-volume senders since 2025. See Google's sender guidelines and Yahoo's sender requirements. Build a new record with our SPF generator.

Checking email addresses rather than domains? Try our free email checker or see pricing for lists and the API.