SPF Record Checker & Lookup Counter

Check a domain's SPF record online: recursively expands every include and redirect, counts DNS lookups against the RFC 7208 limit of 10, and flags void lookups, multiple SPF records, +all, ptr and over-long strings. Free, no signup.



How to use it
  1. Enter a domain (or an email address; the part after @ is used) and click Check SPF. To test a change before you publish it, paste the new record in the optional box.
  2. The checker fetches the TXT record, then follows every include: and redirect= and shows the expanded tree with each DNS-querying term numbered.
  3. Count stays at 10 or under: include, a, mx, ptr, exists and redirect each cost one lookup, nested ones included. ip4, ip6 and all are free. Go over 10 and receivers return permerror, which DMARC treats as an SPF fail.
  4. Fix every ERROR line first, then the WARN lines.


Audit hundreds of domains at once
Need SPF, DMARC and MX checks across a whole client list? Run the Bulk SPF / DMARC / MX Auditor on Apify ($2 per 1,000 domains).
FAQ
What is the SPF 10 DNS lookup limit?
RFC 7208 caps the mechanisms that need a DNS query (include, a, mx, ptr, exists and the redirect modifier) at 10 per SPF check, nested includes counted. Going over makes receivers return permerror, so SPF fails for every message.
How do I fix "too many DNS lookups"?
Remove includes for services you no longer use, replace a and mx with the ip4/ip6 ranges they resolve to, ask vendors for a smaller include, or move bulk senders (newsletters, ticketing) to a subdomain with its own SPF record.
What is a void lookup?
A DNS query from SPF that comes back NXDOMAIN or with no records, usually an include for a vendor that changed its hostname. More than 2 void lookups is a permerror.
Can a domain have two SPF records?
No. Two TXT records that start with v=spf1 is a permerror. Merge them into one record with every include in it.
Should I use ~all or -all?
~all (softfail) is the safe default while you find every sender. With DMARC at p=quarantine or p=reject either works, because DMARC makes the final decision. Never use +all.
Want the full kit?
Runbooks, checklists and helpdesk templates: IT Admin Packs on Gumroad.