SPF record checker

The ten lookup limit

Evaluating an SPF record is allowed a maximum of ten DNS lookups. Each include:, a, mx, exists and redirect costs one, and those includes have includes of their own. Cross the limit and receiving servers return permerror and stop evaluating — SPF provides no protection at all, while the record still looks perfectly correct in your DNS panel.

How domains get there

Microsoft 365 plus a CRM plus a marketing platform plus an invoicing tool plus a helpdesk is five includes, and several of those cost three or four lookups internally. Nobody adds a tenth sender on purpose. It happens over three years, one department at a time.

Fixing it

First remove services that are no longer used — this usually solves it outright. If it does not, flatten the record by replacing includes with the IP ranges they currently resolve to, and put a calendar reminder to re-check them, because flattened records go stale silently.

Common questions

Should my record end in ~all or -all?

~all (softfail) is the right default when you have DMARC in place, because DMARC makes the real decision and softfail avoids losing mail during changes. -all (hardfail) is stricter and appropriate once you are confident every sender is listed.

Can I have two SPF records?

No. Two v=spf1 TXT records on the same name is a permanent error and receivers ignore SPF entirely. Merge them into one.

Does SPF alone stop spoofing?

No. SPF breaks when mail is forwarded, and it validates the envelope sender rather than the From address a human sees. SPF plus DKIM plus an enforcing DMARC policy is what actually stops spoofing.