Check an SPF record, expand every include and count DNS lookups against the limit of 10
Runs in your browser. Only the lookup you start is sent to cloudflare-dns.com or dns.google; nothing else leaves your device. Updated on 25 Oct 2026.An SPF checker reads the TXT record that lists which servers may send mail for a domain, follows every include and redirect, and counts the DNS lookups. RFC 7208 allows at most 10 lookups and 2 empty ones; a record over either limit fails at every receiver, however correct it looks.
Type the domain, such as example.com, in the Domain field.
Press Check SPF to read the record and follow every include.
Read the count of DNS lookups out of 10 and how the record ends, shown under the verdict.
Read Expanded, with each lookup numbered to see which include adds the most lookups.
Press Copy the tree to keep the expanded record.
Type a domain and the page asks a public DNS-over-HTTPS resolver (Cloudflare or Google, your choice) for its TXT records, picks out the one that starts v=spf1, and reads it term by term. Every include: and redirect= is followed, and the records they point at are read the same way, so the whole tree of allowed networks is laid out on one screen.
The count that matters is the number of DNS lookups. RFC 7208 section 4.6.4 limits a check to 10 terms that need DNS: include, a, mx, ptr, exists and redirect each count one, wherever they appear in the tree, while ip4, ip6 and all count nothing. Each counted term is numbered in the tree, so when a record goes over you can see which include pushed it there. Lookups that find nothing, called void lookups, are limited to 2, and a name that no longer exists is shown as void.
The verdict lists what receivers will actually do: two SPF records at one name is a permanent error, +all lets anyone send as the domain, ?all or a missing all gives no answer for unlisted servers, ptr is discouraged, and terms after all are never read. ~all asks receivers to mark mail from unlisted servers; -all asks them to fail it. Each line cites the section of RFC 7208 it comes from.
What it does not do: it checks the record, not a message. Terms with macros such as %{i} are filled in from each message's sending address, so they are counted but not looked up. It cannot tell whether a particular server's address is covered unless that address appears in the record.
The generator tab writes a record from choices, with the Google Workspace and Microsoft 365 includes those providers document, and shows how many lookups it uses before the providers' own.
The domain you type is sent to the resolver you pick, because a lookup needs it. Nothing else leaves your device.
RFC 7208 lets a receiver make at most 10 DNS lookups while checking one SPF record, counting every include, a, mx, ptr, exists and redirect in the whole tree. Over 10, the result is a permanent error and SPF fails for every message, even from servers the record lists.
Both are valid. A record ending -all asks receivers to fail mail from servers not listed; ~all asks them to accept it but mark it as suspicious. Many domains start with ~all while they find every sender, then move to -all. Ending with +all or no all at all gives no protection.
No. RFC 7208 says a domain must publish exactly one TXT record starting v=spf1. With two, receivers cannot choose and return a permanent error, so SPF fails for all mail. Merge them into one record, keeping every include and address from both.
An ip4 or ip6 term already holds the address range, so checking it needs no DNS query. Include, a, mx, exists, ptr and redirect all need at least one query to find out what they stand for. Replacing a stable include with its address ranges is the usual way to get under 10.
Yes, the domain name goes to the public DNS resolver you pick, Cloudflare or Google, because a DNS lookup needs it. The resolver sees the names looked up and your IP address, as with any DNS query. Nothing else leaves your device, and this site stores nothing about the check.
A void lookup is a DNS query that finds nothing: the name does not exist, or it exists with no record of the type asked for. RFC 7208 asks receivers to allow no more than 2, because a record full of dead names is a common attack on receivers. Remove names that no longer exist.
Still stuck? Ask about SPF Checker and anybody who knows can answer. No account needed.
Same job, other tools: DMARC Record Generator – Build a DMARC record step by step, from p=none reporting to p=reject.
On the related tools: Find the Sender IP of an Email – Paste the headers of an email to find the IP address of the server that sent it.
Also works as: SPF Lookup.