SuperMailOS
Start free

Free tool · no signup

Check your SPF record, every include unrolled.

We follow every include, count the DNS lookups against the limit of 10, flag empty lookups, duplicate records and risky endings, and suggest a corrected record when the fix is mechanical.

01 How SPF breaks

The quiet ways SPF fails.

SPF rarely fails loudly. A record can look fine in your DNS panel and still be treated as broken by every receiver. These are the usual causes.

More than 10 lookups

Every include, a, mx, ptr, exists and redirect costs a DNS lookup, and includes pull in their own. Past ten, receivers stop and return a permanent error, which counts as a fail.

Two SPF records

A domain may publish exactly one record starting v=spf1. Adding a second one for a new tool, instead of merging, breaks SPF for all of your mail.

Empty lookups

An include or a mechanism pointing at a name with nothing in DNS is a “void” lookup. More than two of those is also a permanent error.

The ending

~all and -all tell receivers to distrust everyone else. ?all says nothing, and +all authorises the entire internet to send as you.

02 Questions

Common questions.

Something else? Write to us — a real person answers, usually the same day.

Talk to us
What is the SPF 10-lookup limit?+
RFC 7208 caps an SPF evaluation at 10 DNS lookups. The mechanisms include, a, mx, ptr and exists, and the redirect modifier, each cost one, including those inside records you include. ip4, ip6 and all are free. Exceed 10 and the result is a permanent error, which receivers treat as a failure.
How do I get under 10 lookups?+
First remove includes for services you no longer use. Then move bulk or marketing senders to a subdomain (news.yourdomain) with its own SPF record. Flattening, replacing includes with the IP ranges they resolve to, works too, but it needs updating whenever the provider changes its IPs.
Should my record end in ~all or -all?+
Either is fine with DMARC in place. ~all (soft fail) is the common choice because DMARC, not SPF, makes the final call and forwarding can trip a hard fail. Never use +all, and avoid ?all, which gives receivers no guidance.
Can I have two SPF records?+
No. Two records starting with v=spf1 at the same name is a permanent error. Merge them into one: keep a single v=spf1 at the start, combine the mechanisms, and keep one all at the end. The checker suggests the merged record for you.

03 More free tools

Keep checking.

Each tool answers one question about a domain's email. All free, no signup.

All free tools ▶
Authentication→

DMARC checker

Every DMARC tag explained, report destinations verified, and the next step toward p=reject.

DNS & domains→

Who sends email for a domain

Mailbox host and every sending service behind a domain, read from MX, SPF and DKIM.

Authentication→

Spoofing checker

A straight verdict on whether a domain's From address can be forged, and how to close the gap.

Email records that never break.

Every domain you run in one inbox, from $3 a mailbox. 14 days free, no card.

Start free Talk to us