Validate SPF records with the real RFC 7208 include-chain walk and 10-lookup budget
What is the SPF Checker?
The spf checker works like this: it parses the domain’s SPF TXT record and walks the ENTIRE include chain with the RFC 7208 ten-DNS-lookup budget - the same way receiving mail servers evaluate it - reporting the effective all qualifier, every authorized network, void includes and permerrors that break evaluation. Everything happens on your device - the input never leaves your tab unless the tool clearly states it performs a server-side lookup.
How to use the SPF Checker
Enter the domain (e.g. example.com) and press Check.
Look at the effective -all / ~all / ?all / +all line first - it decides what happens to unauthorized senders.
Check the DNS lookup counter: more than 10 means receivers stop evaluating your SPF entirely (permerror).
Review the mechanism table and the recommended fixes before editing your DNS.
Features
Real RFC 7208 evaluation: include chains are followed recursively, not just counted
The 10-DNS-lookup budget is enforced and reported, so permerror records are caught
Detects multiple SPF records (a permanent error most checkers silently ignore)
Follows redirect= targets and reports the effective policy honestly
Common mistakes to avoid
Ending the record with ~all or ?all instead of -all, leaving spoofing possible
Stacking so many includes that the record exceeds 10 DNS lookups and stops being evaluated at all
Publishing two SPF records because two departments "each added theirs" - receivers must treat that as an error
Keeping ip4 blocks for services you stopped using years ago
Getting a reliable answer for spf checker without installing an app
One-off tasks done in under a minute from any device
Checking results before committing them to something important
Working on a phone where desktop software is unavailable
Privacy
The domain name you type is sent to this site’s DNS lookup endpoint only to retrieve the public record and walk its public include chain. Nothing is stored beyond a short cache.
Frequently asked questions
What is the difference between -all, ~all and ?all?
-all tells receivers to reject unauthorized senders (recommended once all legitimate senders are listed). ~all marks them as softfail - they still arrive, usually in spam. ?all is neutral: the record authorizes nothing and blocks nothing.
Why does my SPF fail with "too many lookups"?
RFC 7208 allows at most 10 DNS lookups per evaluation (each include, a, mx, exists or redirect counts). Deep include chains blow this budget, and receivers then return permerror - your SPF simply stops working. Flatten the record or remove unused senders.
I have two SPF records - is that a problem?
Yes. The standard allows exactly one. Multiple records are a permanent error: receivers cannot evaluate your SPF at all. Merge everything into a single v=spf1 record.
Does SPF break email forwarding?
It can - forwarded mail often fails SPF because the forwarder’s server is not in your record. That is precisely what DKIM survives and DMARC alignment handles. Enable DKIM rather than weakening SPF for forwarders.
Related tools
DMARC Checker - Check a domain’s live DMARC policy: enforcement level, report addresses and alignment
DKIM Checker - Find DKIM public keys on common selectors and inspect key type, size and flags
Domain Age Checker - Look up domain age, registrar, expiry and nameservers from the official registry