TinyPingTinyPing

SPF Checker

Check a domain's SPF record: every mechanism, the DNS lookup count out of 10 including nested includes, the all qualifier and duplicate records. Enter a domain such as example.com.

Common SPF problems

Multiple SPF records

A domain may publish only one TXT record starting with v=spf1. With two, receivers return a permanent error and SPF fails for all your mail. Combine the mechanisms into a single record, for example v=spf1 include:_spf.google.com include:sendgrid.net -all.

Too many DNS lookups (permerror)

SPF allows at most 10 mechanisms that need a DNS lookup: include, a, mx, ptr, exists and redirect, counting every nested include. Over 10 is a permanent error. Drop services you no longer use, avoid ptr, and replace a or mx with ip4 or ip6 ranges where you can.

Void lookups

An include or a mechanism pointing at a name that does not exist, or that has no record, is a void lookup. More than 2 is a permanent error. They usually come from includes of a provider you left or a typo in the include domain.

Using +all or no all at the end

+all lets any server on the internet pass SPF for your domain, which defeats the point. A record with no all and no redirect ends as neutral. End the record with -all (fail) or ~all (softfail).

A sending service is missing

Mail from a CRM, helpdesk, billing system or website contact form fails SPF if its servers are not in your record. Check each tool's setup guide for its include and add it to your existing record.

Syntax errors

A missing space, a stray quote, include: with no domain, or ip4 with a malformed range breaks the whole record. Copy values carefully and check again after saving.

How to check an SPF record

  1. Enter the domain in your From address, for example example.com.
  2. Click Check SPF.
  3. Review each mechanism, the lookup count and the all qualifier.
  4. Fix errors first (duplicates, over 10 lookups), then check again after the record's TTL.

What is an SPF record?

SPF (Sender Policy Framework, RFC 7208) is a TXT record that lists the servers allowed to send email for a domain. When a message arrives, the receiving server takes the domain from the envelope sender (the Return-Path, not always the From line you see), reads its SPF record and checks whether the connecting IP address is allowed.

The record is read left to right. ip4 and ip6 match addresses directly. include pulls in another domain's SPF record, which is how you authorise Google Workspace, Microsoft 365 or a newsletter tool. a and mx allow the addresses of those records. The first match decides the result.

The all mechanism at the end catches everything else. -all means fail, ~all means softfail (accept but treat as suspicious), ?all means neutral. Many domains use ~all while setting up and -all once every sender is listed. With DMARC in place, either works well.

To keep lookups cheap, SPF limits a check to 10 DNS lookups and 2 void lookups. Going over either is a permanent error, which receivers treat as SPF failing.

example.com.  3600  IN  TXT  "v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.10 -all"

When to use an SPF checker

Adding Google Workspace or Microsoft 365

Add include:_spf.google.com or include:spf.protection.outlook.com to your existing record instead of creating a second one, then confirm here that there is only one SPF record.

Connecting Mailchimp, SendGrid or Amazon SES

Every new sending service adds includes. Check the lookup count after each one, since a few providers with nested includes can reach 10 quickly.

WordPress or Shopify contact form mail fails

Messages sent from your web host's server fail SPF when the host is not listed. Check whether the host's IP or include is in the record, or switch the site to send through your email provider.

Cleaning up after a migration

After leaving a provider, remove its include. Old includes waste lookups and can turn into void lookups when the provider retires the name.

Check something else

Frequently asked questions

Can a domain have two SPF records?

No. RFC 7208 allows one SPF record per domain, and two produce a permanent error, so SPF fails. Merge the mechanisms into one record that starts with v=spf1 and ends with a single all.

What counts toward the 10 lookup limit?

The include, a, mx, ptr, exists mechanisms and the redirect modifier each cost one lookup, including those inside nested includes. ip4, ip6 and all do not. This checker follows nested includes and shows the total.

Should I use -all or ~all?

-all asks receivers to reject mail from servers not listed, ~all asks them to accept it but mark it suspicious. Use ~all while you confirm every sender is listed, and -all once you are sure. With DMARC at quarantine or reject, the DMARC policy is what usually decides.

Does SPF check the From address I see in my inbox?

No. SPF checks the envelope sender (Return-Path), which services like SendGrid often set to their own domain. DMARC is what connects SPF to the visible From domain, through alignment.

My SPF record is too long. What can I do?

A single TXT string is limited to 255 characters, but a record can be split into several quoted strings that receivers join together. Most DNS panels do this for you. If the problem is lookups rather than length, remove unused includes or use ip4 and ip6 ranges.

How long until an SPF change takes effect?

Up to the old record's TTL for receivers that cached it, often an hour or less. Check here after saving to confirm the new record is what public resolvers return.

Stop finding outages from customer emails

TinyPing does not monitor SPF or other DNS records, so recheck them here after changes. It does check your site every 5 minutes and alerts you when:

  • the website returns an error or times out
  • the domain stops resolving
  • a mail server port you run stops accepting connections
Start monitoring free for 7 days

US$6.99 a month or US$47 a year per 50 monitors, team members free. 7-day free trial, no card needed.

Want alerts in team chat? Follow the guide for Slack or Google Chat.