SPF record checker

Check the SPF record of any domain. Type a domain or an email address: the checker follows every include, counts the DNS lookups against the limit of 10 and writes a corrected record when something is wrong. Free, with no sign-up.

SPF record of lumen-advisory.example

This is an example for a made-up domain. Type your own domain above to check it.

DNS for this domain is managed at Cloudflare. Make the changes there.

SPFThe SPF record needs 11 DNS lookups, but the limit is 10.Fail
Receivers stop after 10 DNS lookups and treat SPF as failed. Each include, a, mx, ptr and exists term costs one lookup, and the includes inside an include cost more.
DNS lookups: 11 of 10
- include:_spf.google.com1 lookup
- include:sendgrid.net2 lookups
- include:ab.sendgrid.net1 lookup
- include:mailgun.org5 lookups
- include:_spf.mailgun.org3 lookups
- include:_spf1.mailgun.org1 lookup
- include:_spf2.mailgun.org1 lookup
- include:_spf.eu.mailgun.org1 lookup
- include:_spf.salesforce.com2 lookups
- exists:%{i}._spf.mta.salesforce.com1 lookup
- include:servers.mcsv.net1 lookup
What we found
```
v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org include:_spf.salesforce.com include:servers.mcsv.net -all
```
How to fix it
This record keeps only Google Workspace and your own IP addresses. Add back only the services that still send as this domain, and keep the total at 10 lookups or fewer.
Type
TXT
Name
lumen-advisory.example
Value
v=spf1 include:_spf.google.com -all
Publish it as a TXT record at lumen-advisory.example, in place of any SPF record already there. This record uses 1 of the 10 DNS lookups SPF allows.
Many DNS panels want only the part before your domain: @ for the domain itself, _dmarc for DMARC.

Check MX, SPF, DKIM and DMARC together SPF record generator

An SPF record fails at 11 DNS lookups, even when every part of it is correct.

Receivers count DNS lookups while they read your SPF record. Each include, a, mx, ptr and exists term costs one, and the includes inside an include cost more. At the 11th lookup they stop with a permanent error, which counts as no SPF at all.

The tree in the report shows where each lookup comes from, so you can see which service costs the most and remove the ones you no longer use.

Each service's include costs a different number of lookups.

We counted each service's documented include on live DNS: the include itself plus every lookup inside it. Services change their records, so check your own record above instead of adding these numbers up.

Measured on live DNS on 18 October 2026: the include plus every lookup inside it.
Service	Include	Lookups
Google Workspace	`include:_spf.google.com`	1 lookup
Microsoft 365	`include:spf.protection.outlook.com`	1 lookup
Fastmail	`include:spf.messagingengine.com`	1 lookup
Amazon SES	`include:amazonses.com`	1 lookup
Mailchimp	`include:servers.mcsv.net`	1 lookup
Postmark	`include:spf.mtasv.net`	1 lookup
Brevo	`include:spf.brevo.com`	1 lookup
Zendesk	`include:mail.zendesk.com`	1 lookup
Zoho Mail (zohomail.com)	`include:zohomail.com`	2 lookups
Zoho Mail (zohomail.eu)	`include:zohomail.eu`	2 lookups
Proton Mail	`include:_spf.protonmail.ch`	2 lookups
SendGrid	`include:sendgrid.net`	2 lookups
Salesforce	`include:_spf.salesforce.com`	2 lookups
Mailgun	`include:mailgun.org`	5 lookups

A domain can have only one SPF record.

When a domain has two TXT records that start with v=spf1, receivers stop with a permanent error. This often happens when another service tells you to add its own record. Merge them into one record: keep every include and address, and end the record once, with ~all or -all.

Each part of an SPF record has one job.

v=spf1: Marks the TXT record as SPF. It must come first.
include:: Allows every server that another domain's SPF record allows. Costs one lookup plus the lookups inside it.
ip4: and ip6:: Allow one address or a range. They cost no lookup.
a and mx: Allow the servers in your domain's A or MX records. They cost one lookup each.
~all: Marks mail from every other server as suspicious. The usual choice while you set things up.
-all: Tells receivers that they may refuse mail from every other server.
redirect=: Uses another domain's SPF record in place of this one. Costs one lookup.

Common questions about SPF records

What does an SPF checker show?

The SPF record that the domain publishes, every include it pulls in, how many of the 10 DNS lookups it costs, how it ends, and a corrected record when something is wrong.

How do I fix too many DNS lookups?

Remove the includes of services you no longer use, starting with the most expensive ones in the lookup tree. Replace an include with the ip4 or ip6 ranges it allows only if the service publishes fixed ranges, because they can change.

Should my SPF record end in ~all or -all?

~all is the safe start: mail from servers you did not list is marked as suspicious. Move to -all when you are sure that every service that sends as your domain is in the record.

Does SPF alone get my mail delivered?

No. Receivers also check DKIM and DMARC, and DMARC passes only when SPF or DKIM passes for your own domain. Check all four records with the email domain checker.

How long does an SPF change take to show?

Usually a few minutes to an hour, depending on the record's time to live (TTL). Our checker reuses an answer for one minute, so check again after that.