SPF checker
See every include in your SPF record, count the DNS lookups against the limit of 10, and get a fixed record to paste.
What the SPF checker does
SPF is a TXT record that starts with v=spf1 and lists the servers allowed to send mail for a domain. When a message arrives, the receiver looks up the SPF record of the domain in the envelope sender, also called the Return-Path, and checks whether the connecting IP is on the list.
The checker runs the same evaluation. It fetches the record, follows every include and redirect, draws the tree, and counts DNS lookups against the limit of 10 in RFC 7208. It also counts void lookups and flags syntax errors, a second SPF record, +all, ?all and the deprecated ptr mechanism.
How the 10-lookup limit works
RFC 7208 section 4.6.4 caps the terms that trigger DNS queries at 10 per evaluation. include, a, mx, ptr and exists each count, and so does the redirect modifier, at every level of nesting. ip4, ip6 and all don't count, and neither do the lookup for the record itself or the exp modifier.
Go over 10 and the receiver returns permerror. DMARC only accepts an SPF pass, so a permerror means SPF stops helping every message you send, not only the ones from the tool you added last.
Includes can cost more than they look. An include that nests other includes costs a lookup for each of them too. Add a CRM, a help desk and a sending tool, each with nested includes of its own, and a record can pass 10 without anyone noticing.
Void lookups and other errors
A void lookup is a query that returns no records or NXDOMAIN, usually from an include that points at a domain that no longer publishes SPF. RFC 7208 recommends a limit of 2, and receivers that enforce it return permerror on the third. The checker also flags:
- Two TXT records that start with v=spf1. RFC 7208 makes that a permerror, so receivers ignore both.
- +all, which lets any server on the internet pass as you, and ?all, which says nothing about servers you didn't list.
- The ptr mechanism. RFC 7208 says not to use it because it is slow and unreliable.
- Records long enough to push the DNS reply past 512 bytes, which some receivers fail to fetch.
Why SPF matters for cold email
Gmail and Yahoo require SPF or DKIM from every sender, and both plus DMARC from bulk senders. Every service that sends as your domain has to be covered: your mailbox provider, your sequencer if it sends over its own SMTP, and anything else with your domain in the Return-Path.
SPF only helps DMARC when it aligns, meaning the Return-Path domain shares its organizational domain with the From address. Many sending tools use their own bounce domain, so SPF passes for them and does nothing for your DMARC. DKIM signed with your own domain covers that gap.