More than one record
A domain may only publish one SPF record. Two or more is an error, and receivers treat SPF as broken.
Free tool
SPF record checker
Look up any domain’s SPF record and find out whether it actually works — including the 10-lookup limit that silently breaks SPF for so many businesses.
Nothing is stored. Works with any domain, not just ours.
What it checks
Four things that break SPF
An SPF record can be published and still fail every message. These are the faults we look for.
Too many DNS lookups
We follow every include, and the includes inside them, and count the lookups. Over 10 and SPF fails for every message.
A risky ending
“+all” lets any server on the internet send as you. “?all”, or no “all” at all, gives receivers no instruction.
Broken includes
An include pointing at a domain with no SPF record, or the deprecated “ptr” mechanism, is flagged so you can tidy it up.
What SPF does — and what it does not
SPF (Sender Policy Framework) is a TXT record on your domain listing the servers allowed to send email for it. A receiving server compares the server that delivered a message with that list.
The catch is which address SPF checks. It looks at the hidden envelope sender (the Return-Path), not the From address your recipient sees. On its own, SPF therefore does little to stop someone putting your address in the From line. That is DMARC’s job: it requires SPF or DKIM to pass for the visible From domain. Check yours with the DMARC checker.
The 10-lookup limit
To stop SPF being used to flood DNS, receivers will make at most 10 DNS lookups while evaluating your record.
Every include:, a, mx, ptr, exists: and
redirect= costs one — and an include can contain more includes. Microsoft 365 alone uses a few. Add a
newsletter platform, a CRM, an invoicing system and a website form service, and it is easy to reach 11 without
noticing. Above 10, SPF returns a permanent error for every message, which most receivers treat as a failure.
The fix is to remove services you no longer use, and to check whether a service can authenticate with DKIM on your domain instead of an SPF include. Be wary of “SPF flattening” — replacing includes with IP addresses. It gets you under the limit today, but breaks quietly when a provider changes its addresses.
Fixing a failed result
- No SPF record: build one with our SPF record generator and publish it as a TXT record on the domain itself.
- Two records: merge them into one. Keep a single
v=spf1at the start and oneallat the end. - Ends in +all: change it to
~allstraight away. This one is genuinely dangerous. - A domain that never sends email should publish
v=spf1 -all, which tells receivers to reject anything claiming to come from it. The checker recognises this setup.
Our guide to SPF, DKIM and DMARC explains how the three records work together.
Questions
About SPF
Why does my SPF fail with “too many DNS lookups”?
Receivers will make no more than 10 DNS lookups to evaluate SPF, and includes count the lookups inside them too. Remove services that no longer send as you, and use DKIM for services that support it rather than adding another include.
Can a domain have two SPF records?
No. If a domain publishes more than one record starting v=spf1, receivers return an error and SPF fails. Merge them into a single record.
Should my SPF record end in ~all or -all?
Start with ~all (soft fail) while you confirm every sender is listed. Once your DMARC reports show nothing legitimate failing, -all is stricter. With DMARC enforced, DMARC decides what happens to failing mail, so the difference matters less.
Does SPF stop people spoofing my domain?
Not by itself. SPF checks the hidden envelope sender, not the From address people see. DMARC links the two, so you need SPF, DKIM and a DMARC policy together.
Is the lookup count exact?
It follows includes and redirects up to four levels deep, which covers real-world records. A record with includes nested deeper than that could use more lookups than we report.
Related tools and guides
Rather have it done for you?
SPF, DKIM and DMARC are set up and monitored for every MyExchangeServer customer. Or send us your results for a second opinion from an engineer.
- Free assisted migration
- No set-up fee, no minimum term
- UK data centres, UK engineers