Skip to content
LookupOwl

SPF record checker

See who is allowed to send mail for a domain, and count the DNS lookups against the limit of 10.

The domain whose mail you want to check.

Try:

What an SPF check tells you

The checker finds a domain's SPF record and reads it the way a receiving mail server does. It tells you whether the record is valid, which senders it allows, what it says about everyone else and how many of the 10 allowed DNS lookups it uses. A record that breaks the rules, or needs more than 10 lookups, stops working, and the domain loses a main defence against forged mail.

SPF (Sender Policy Framework) is a TXT record in which a domain lists the servers allowed to send its email. A receiving server compares the IP address that delivered a message with that list. SPF checks the hidden envelope sender, also called the return path, and not the From address people see.

How to check a domain

  1. Enter the domainUse the domain in your email addresses, for example example.com. An email address or a web address is reduced to its domain.
  2. Read the verdict and the meterThe top tile says whether the record is valid. A meter shows how many of the 10 lookups it uses, and the policy tile shows how the record ends. The Evaluation tab lists every record the check visited, with the lookups each one costs.
  3. Fix, publish and check againEdit the record at your DNS host, or build a new one with the SPF generator. Results are kept for up to five minutes, so use Check again after you publish.

How to read an SPF record

An SPF record is a list of terms read from left to right. The first term that matches the sending server decides the result. A typical record looks like this:

Text
v=spf1 ip4:203.0.113.0/28 include:_spf.google.com include:sendgrid.net -all
TermMeaningCounts as a DNS lookup?
ip4: / ip6:Allows an address or a network directly.No
include:domainAlso accepts whatever that domain's SPF record allows.Yes, plus the lookups inside that record
a / mxAllows the domain's own A/AAAA or MX hosts.Yes, one each. The address lookups behind an mx are not counted again, but an mx with more than 10 hosts is an error
exists:Matches if the named DNS name has an A record. Used with macros.Yes
redirect=domainUses another domain's record instead of this one. Ignored if the record also has all.Yes
ptrDeprecated reverse-DNS match. Avoid it.Yes
allMatches every sender. Put it last: terms after it are never read.No
QualifierResult on a matchTypical use
+ (default)PassAllowed senders
-Fail-all: ask receivers to reject everyone not listed
~Softfail~all: accept the mail but mark it as suspicious. Common while testing.
?Neutral?all: make no statement. It gives no protection.

The lookup count is the worst case. LookupOwl adds up every term that needs a lookup, through the whole tree of includes, as if every term were evaluated. A real receiver stops at the first match, but a record has to work for every sender. Terms with macros, such as exists:%{i}._spf.example.com, depend on who is sending, so they are counted but not expanded.

Problems the checker finds

  • More than 10 DNS lookups. The most common failure. Over the limit, receivers return a permanent error (permerror) and ignore the record. The checker warns from 8 lookups, and its Evaluation tab shows which include costs the most. The questions below explain the limit and how to get under it.
  • More than 2 void lookups. A void lookup is a query that returns nothing, such as an a host that does not exist. RFC 7208 recommends that receivers stop at two and treat more as a permanent error, so the checker reports it as an error. Remove the terms that point at empty names.
  • More than one SPF record. Two records that start with v=spf1 cause a permanent error, and receivers ignore both.
  • An include that fails. An include: or redirect= that points at a domain with no SPF record, or at a domain that does not exist, is a permanent error. So is an include loop. Check the spelling, or remove the term.
  • +all or ?all. +all allows the whole internet to send as the domain. ?all says nothing. Both defeat the purpose.
  • No all term. Without a final all or a redirect, unlisted senders get a neutral result. The checker mentions it as a hint.
  • Terms after all. They are never read. Move all to the end.
  • An unknown term. A misspelled mechanism such as includes:, or an ip4: with an invalid address, makes the record unusable. A record that does not start with v=spf1 and a space, such as v=spf 1, is not an SPF record at all, so the checker reports none.
  • Record too long. One DNS string holds at most 255 bytes, so longer records are split into several strings. Above about 450 bytes the checker warns, because the whole answer may no longer fit in one 512-byte UDP packet (RFC 7208 section 3.4). Larger answers often work anyway, but not everywhere.
  • The ptr mechanism. It is slow and unreliable, and RFC 7208 discourages it.

How the check works

LookupOwl asks DNS for the domain's TXT records and keeps those that start with v=spf1. It parses the record strictly, then follows every include and redirect through DNS and looks up the addresses and mail hosts behind a, mx and exists terms. It counts the lookups and the empty answers across the whole tree, using the rules of RFC 7208.

The walk is kept polite to other people's DNS. It asks at most 60 questions, stops counting at 25 lookups, follows includes up to 12 levels deep and lists up to 40 records. If one of these limits stops it, or a deadline passes, the result says the numbers are lower bounds. Results are kept for up to five minutes.

Shell
dig +short TXT example.com | grep spf1
nslookup -type=TXT example.com

Standards

  • RFC 7208: the SPF specification, with the limit of 10 lookups (section 4.6.4), the recommended limit of two void lookups, the qualifiers and the macros.
  • RFC 5321: SMTP, which defines the envelope sender that SPF checks.
  • RFC 9989: DMARC, which builds on SPF alignment and replaces RFC 7489.
  • RFC 6376: DKIM, the signature mechanism that complements SPF.

Questions people ask

What is the SPF 10 DNS lookup limit?

RFC 7208 lets a receiver follow at most 10 DNS-querying terms while it checks one SPF record. The terms are include, a, mx, ptr, exists and redirect, and lookups inside included records count too. Go over 10 and SPF returns a permanent error, which many receivers treat as a failure, so your own mail can fail SPF.

How do I fix 'too many DNS lookups'?

Start with the include that costs the most, which the Evaluation tab shows. Remove includes for services you no longer use, drop ptr, and replace a or mx with fixed ip4 or ip6 ranges when you control the hosts. Send bulk mail from a subdomain with its own SPF record. Flattening includes into IP lists is a last resort, because providers change their addresses and a stale list silently blocks real mail.

Can a domain have two SPF records?

No. Two records that start with v=spf1 produce a permanent error, and receivers ignore both. Combine all the terms into a single record. If a service tells you to add its own SPF record, add its include: to your existing one instead.

Should I use -all or ~all?

Start with ~all while you confirm that every sender is listed, then move to -all if you want a strict failure. With a DMARC policy of quarantine or reject in place, receivers largely follow DMARC, so ~all is common and enough. -all can make a receiver reject a message before DMARC even looks at it.

Do I need SPF if I use DKIM?

Yes, publish both. DMARC passes when either one passes with alignment, but having both is more robust. DKIM survives plain forwarding better, while SPF needs no signing setup and many receivers still use it as a signal. With only one of them, a single mistake can make DMARC fail.

Why does my SPF pass but mail still goes to spam?

SPF is only one signal. Sender reputation, message content, DKIM, DMARC, reverse DNS and complaint rates all matter too. Check your DMARC record, and check the reverse DNS of the IP address that sends your mail. Also check that SPF passes for the domain in the return path, which can differ from your From domain.

What does 'SPF permerror' mean?

It means a permanent error: the record cannot be evaluated at all. The usual causes are a syntax mistake, two SPF records, an include that does not exist or more than 10 lookups. Receivers cannot use the record, so it gives no protection until you fix it. Retrying never helps, unlike a temporary error (temperror).

Why does the checker say 'at least' before the lookup count?

Because it could not count everything. A term with a macro depends on who is sending, so it is counted but not expanded. The walk may also have hit its limits or run out of time. The true number is at least the one shown, so if it is already over 10, the record needs fixing.

Use it from AI, the API or the command line

Every LookupOwl tool is also a free API and an MCP tool, with no key and no account. This one is spf_check. Please be kind to the rate limits.

curl
curl "https://lookupowl.com/api/v1/tools/spf-checker?q=google.com"
MCP
claude mcp add --transport http lookupowl https://lookupowl.com/mcp

Description for AI agents · OpenAPI · llms.txt