SPF record checker

What the SPF checker tests

• Exactly one v=spf1 TXT record exists.
• Every term is a valid mechanism (all, include, a, mx, ptr, ip4, ip6, exists) or modifier (redirect, exp), with valid IP syntax.
• Total DNS-querying terms, including those inside nested includes, stay within 10.
• Void lookups (2 maximum), include loops and includes with no SPF record.
• Risky qualifiers: +all, ?all, deprecated ptr, and terms after all.

SPF syntax reference

Term	Meaning	Counts as lookup
ip4:203.0.113.0/24	Authorise an IPv4 address or range	No
ip6:2001:db8::/32	Authorise an IPv6 address or range	No
a / mx	Authorise the domain's A/AAAA or MX hosts	Yes
include:_spf.google.com	Use another domain's SPF policy	Yes (plus its own)
exists:	Match if a constructed name resolves	Yes
redirect=	Use another domain's policy entirely	Yes
-all / ~all	Fail / softfail everything else	No

Qualifiers: + pass (default), - fail, ~ softfail, ? neutral.

Fixing "too many DNS lookups"

1. Remove includes for services you no longer use.
2. Replace a and mx with explicit ip4/ip6 where your servers are stable.
3. Move marketing or transactional senders to a subdomain (for example mail.example.com) with its own SPF record. DMARC relaxed alignment still passes for the organisational domain.
4. Flattening into IP lists works but breaks silently when providers change IPs, so monitor it.

Need a new record? Use the SPF generator.

Frequently asked questions