Free tool · SPF record check
SPF Record Checker
Look up a domain’s SPF record, check its syntax and count every DNS lookup — including those inside each include — against the limit of 10.
What an SPF record is
SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers allowed to send its mail. When a message arrives, the receiving server checks whether the server that delivered it is on that list.
A typical record looks like this:
v=spf1 include:_spf.google.com include:mail.example-crm.com ip4:203.0.113.10 ~all| Term | Meaning | DNS lookup? |
|---|---|---|
v=spf1 | Marks the TXT record as SPF. Must come first. | — |
ip4: / ip6: | An address or range that may send. | No |
include: | Also allow everything another domain’s SPF record allows. Used for mail services. | Yes, plus any inside it |
a / mx | Allow the domain’s own web (A) or mail (MX) servers. | Yes |
exists:, ptr, redirect= | Less common; ptr should not be used. | Yes |
~all / -all | What happens to servers not listed: soft fail or fail. | No |
The 10-lookup limit
Receivers stop after 10 DNS-querying terms. Those are include, a, mx, ptr, exists and redirect; ip4, ip6 and all don’t count (RFC 7208, section 4.6.4). Past 10, SPF returns a permanent error — and legitimate mail fails along with forgeries.
The catch is that lookups inside an include: count too. Some providers publish a flat list of addresses, so their include costs a single lookup; others include several more records of their own, so one line in your record can use six or seven. This checker follows every include and adds them up, so you see the real total rather than the number of lines you typed.
If you’re over the limit, remove includes for services you no longer use. For a service that publishes fixed IP ranges, list them with ip4:/ip6: instead of the include. Mail sent by a separate tool can also move to a subdomain with its own SPF record.
Only one SPF record per domain
A domain must have exactly one TXT record starting with v=spf1. With two, receivers can’t tell which to use and SPF fails with a permanent error (RFC 7208, section 4.5). This usually happens when a new service’s setup guide says “add this SPF record” and an existing one is left in place. Merge them into one record instead — the checker builds the merged version for you.
~all or -all?
Both are fine. Google recommends ~all (soft fail) for Google Workspace. Microsoft recommends -all (fail) for Microsoft 365 domains that also have DKIM and DMARC, because DMARC then acts on mail that fails SPF and has no DKIM signature. Avoid ?all, which gives receivers nothing to act on, and never use +all, which approves every server on the internet.
SPF records for common providers
| Mail service | Record when it’s your only sender |
|---|---|
| Google Workspace | v=spf1 include:_spf.google.com ~all |
| Microsoft 365 | v=spf1 include:spf.protection.outlook.com -all |
| Microsoft 365 GCC High and DoD | v=spf1 include:spf.protection.office365.us -all |
| Microsoft 365 operated by 21Vianet | v=spf1 include:spf.protection.partner.outlook.cn -all |
Add an include: (or ip4:) for every other service that sends as your domain — newsletters, invoicing, your website’s contact form — before the final all.
Questions
How many includes can an SPF record have?
There’s no separate limit on includes; the limit is 10 DNS lookups in total, and each include uses at least one plus any lookups inside it. A record with five includes can easily exceed 10.
What does “SPF permerror” mean?
The record can’t be evaluated: there are two SPF records, a term has a typo, an include points to a domain with no SPF record, or the lookups exceed 10. Receivers then treat SPF as failed or absent.
Does a subdomain inherit the SPF record?
No. SPF is checked on the exact domain used, so a subdomain that sends mail needs its own SPF record.
Is SPF enough on its own?
No. SPF breaks when mail is forwarded, and it checks the hidden envelope sender rather than the From address readers see. Add DKIM, and DMARC to tie both to your From domain.
My record is longer than 255 characters. Is that a problem?
A single TXT string is limited to 255 characters, but a record can be split into several strings that receivers join together. Most DNS panels do this for you automatically.
Sources
More free tools
Check something else
Setup guides