SPF Checker
Use this SPF checker to read the SPF record of a domain, follow every include and count the DNS lookups it needs. SPF lists the servers that may send email for a domain. A record that needs more than 10 lookups fails.
The Uptrack server reads the records through the public DNS resolver of Cloudflare and follows every include for you. A check can take a few seconds.
Try an example
SPF checker: what the result shows
- The record
- The SPF record is a TXT record on the domain itself. It starts with v=spf1 and ends with an all term.
- DNS lookups
- How many of the 10 allowed lookups the record uses, counting every include and redirect it follows.
- The all term
- -all rejects mail from servers you did not list. ~all marks it as suspicious. ?all and +all give no protection.
- Included records
- The SPF records of the services you include, such as your email provider, with the lookups each one adds.
SPF record lookup limit: why 10 matters
The SPF standard (RFC 7208) lets a receiver make at most 10 DNS lookups while it checks a record. The terms include, a, mx, ptr, exists and redirect each count as one. The terms ip4, ip6 and all do not. Every include also adds the lookups of the record it points to.
A record over the limit fails with a permanent error, and receivers may treat your mail as unauthenticated. To get back under the limit, remove services you no longer use, or replace an include with the ip4 and ip6 ranges you control.
Common SPF record errors
- Two SPF records
- A domain may have only one. Merge them into a single record.
- +all
- Lets any server send mail as your domain. Use -all or ~all.
- An include with no SPF record
- The named domain has no record, so SPF fails. Remove the include or fix the name.
- The ptr term
- It is deprecated. It is slow and some receivers ignore it.
Frequently asked questions
What is an SPF record?
An SPF record is a TXT record that lists the servers allowed to send email for a domain. A receiving server compares the sending address with the list to decide if the message is genuine.
How many DNS lookups can an SPF record use?
Ten. The terms include, a, mx, ptr, exists and redirect each count as one, and every include adds the lookups of the record it points to. Above ten, SPF fails with a permanent error.
What is the difference between -all and ~all?
With -all, a message from a server you did not list fails SPF and can be rejected. With ~all, it is a soft fail: the message is usually still delivered but may be marked as suspicious. Many senders start with ~all and move to -all.
Can a domain have more than one SPF record?
No. Two SPF records on one domain make SPF fail with a permanent error. Merge the includes and ip ranges into a single record.
Does SPF alone stop spoofing?
No. SPF checks the hidden envelope sender, not the From address people see. Add DKIM and a DMARC policy so receivers know what to do when a message fails.
Monitor this email DNS record every minute
Uptrack checks your SPF, DKIM, DMARC and MX records on a schedule and alerts you when one changes or stops resolving.
Plans from $3/mo, with a 30-day money-back guarantee.