What this checks
SPF answers a single question: which servers are allowed to send mail using your domain in the
envelope sender — the Return-Path / MAIL FROM address the receiving server sees,
not the From: header your recipients read. This checker reads the published SPF record,
expands its mechanisms (include:, a, mx,
ip4/ip6, redirect), and counts how many of them force the
receiver to perform a DNS lookup while evaluating it.
How to read the results
Two badges lead the result. The all-qualifier badge reports what happens to a server
that isn't listed: -all (strict) tells receivers to hard-fail anything unlisted,
~all (softfail) asks them to accept-but-mark it, ?all stays neutral, and
+all authorizes the entire internet — almost always a mistake. The second badge is the
lookup count: SPF caps the mechanisms that trigger DNS resolution at ten, and a record
over that limit returns permerror, which many receivers treat as no SPF at all.
Common SPF mistakes
- Too many DNS lookups. Chained
include:statements — a provider that includes another that includes another — blow past the ten-lookup ceiling. Flattening (replacing includes with theip4/ip6ranges they resolve to) is the usual fix. +allleft in place. A record ending in+allauthorizes every server on earth; it defeats the entire point of publishing SPF.- Authorizing the wrong identity. SPF checks the envelope sender, so mail that passes
SPF for a bulk vendor can still carry any
From:address — SPF alone never ties the visible sender to your domain. - A forgotten include after adding a sender. Bring on a new source (a helpdesk, a
CRM) and omit its
include:, and that mail starts failing SPF silently.
FAQ
Why is there a 10 DNS lookup limit?
The limit exists so a single SPF check can't trigger an unbounded cascade of DNS queries against
receivers. Every include:, a, mx, ptr,
exists, and redirect counts toward it. Exceed ten and evaluation returns
permerror, and most receivers then behave as if you published no SPF at all.
What's the difference between ~all and -all?
Both cover servers that aren't listed. ~all (softfail) says "this probably isn't us, but
deliver it anyway, marked" — a safe setting while you confirm every legitimate sender is in the record.
-all (hardfail) says "reject anything unlisted." Move to -all once you're
confident the record is complete.
Can I have two SPF records?
No. A domain must publish exactly one SPF record. Two of them is a permerror, and receivers
may ignore both. Merge every sender into a single record instead of adding a second one.
Does SPF stop spoofing on its own?
No. SPF only authorizes the envelope sender and does nothing about the From: address a
recipient actually reads. Stopping visible-From spoofing needs DMARC, which ties an authenticated
identifier to that header.