SPF Record Validator & Builder
Check an SPF record for syntax errors, the 10 DNS lookup limit and a weak fail policy, or build a new SPF record from the email services you use.
Validation
Your new SPF record
How to use the SPF validator and builder
Validate: paste your current SPF record. You can find it by running dig TXT yourdomain.com or with any DNS lookup tool. The checker reviews the syntax, counts DNS lookups against the 10-lookup limit, flags unknown terms and audits your fail policy.
Build: list the services that send email for your domain, such as Google Workspace, Mailchimp or SendGrid, and pick a fail policy. The tool writes a valid record you can paste into your DNS as a TXT record.
Why SPF matters
SPF, DKIM and DMARC are the three standards mailbox providers use to decide whether your email is genuine. A broken SPF record (too many lookups, a missing service or a weak policy) is one of the most common causes of mail landing in spam. A quick check before launch saves weeks of guessing later.
The 10-lookup limit
SPF allows at most 10 DNS lookups while a message is checked. Every include, a, mx, ptr, exists and redirect term counts, and many provider includes contain more lookups of their own. Go over 10 and receivers return a PermError, which means your mail fails SPF. This tool counts the lookups visible in your record, so treat nested includes as extra. Remove services you no longer use, or flatten the record, if you get close.
Common use cases
- Checking deliverability before a new domain starts sending
- Adding a new email service without breaking the existing record
- Troubleshooting DMARC failure reports
- Moving from one email platform to another
Frequently asked questions
What is the difference between -all, ~all and ?all?
-all is a hard fail: mail from unlisted servers should be rejected. ~all is a soft fail: the mail is accepted but marked as suspicious. ?all is neutral and offers almost no protection. +all lets anyone send as you and should never be used. Start with ~all while testing, then switch to -all.
Can a domain have more than one SPF record?
No. RFC 7208 allows only one SPF record per domain, and two records cause a PermError. Many domains end up with two by accident after a migration, so merge them into one.
Does SPF cover subdomains?
No. A record on yourdomain.com does not apply to mail.yourdomain.com. Every subdomain that sends mail needs its own record.
Why does my mail still fail with a correct SPF record?
SPF checks the envelope sender (Return-Path), not the visible From address. If those differ, DMARC alignment can still fail. Set up DKIM and DMARC alongside SPF for full coverage.