SPF Record Checker

Ten DNS lookups, hard limit

SPF evaluation must complete within 10 DNS lookups. Every include, a, mx, ptr and exists mechanism costs one, and includes nest — a single provider include can consume four on its own. Exceed the limit and the result is permerror, which most receivers treat as a failure. Adding one more vendor to a working record is the usual way a domain's mail suddenly starts failing.

The last mechanism decides everything

-all is hard fail, ~all is soft fail, ?all is neutral and +all permits the entire internet to send as you. Records ending ?all or +all provide no protection at all and appear surprisingly often. Start at ~all while auditing, then tighten to -all.

One record per domain

Two SPF records on the same name is a permanent error, not a merge. Adding a second when a new provider is onboarded is a frequent mistake; the mechanisms must go into the existing record instead.

SPF alone does not stop spoofing

It authenticates the envelope sender, not the From header a recipient sees. Alignment between them is what DMARC checks, which is why SPF without DMARC leaves display-name spoofing wide open. It also breaks on forwarding, since the forwarder's IP is not in your record — the reason DKIM matters alongside it.