Enter a domain to look up its SPF record, parse every mechanism, count DNS lookups against the 10-lookup limit and flag risky settings.
This checker looks up the TXT records for a domain using DNS-over-HTTPS and finds the record that starts with v=spf1. A domain should publish exactly one SPF record: none means receiving servers have no published list of authorised senders to check against, and more than one is an error that makes SPF evaluation fail. The record is split into its mechanisms and modifiers, each shown with its qualifier, and the mechanisms that cause a further DNS lookup (include, a, mx, ptr, exists and redirect) are counted against the limit of 10 DNS lookups set by the SPF specification. Includes are listed separately so each included domain can be checked in turn, lookups inside an included record count towards the same limit but are not expanded automatically here, so the count shown is a minimum.
What does the 10-lookup limit mean? SPF allows at most 10 mechanisms and modifiers that cause DNS lookups during one evaluation. Going over the limit produces a permanent error and the check fails, so records that include several third-party senders need the total counted, including lookups inside included records.
What is the difference between -all, ~all and +all? The all mechanism sets the default for senders not matched earlier: -all means fail (not authorised), ~all means softfail (suspect but not rejected on SPF alone), ?all means neutral, and +all means pass for any sender, which defeats the purpose of SPF and is flagged here as a fail risk.
Why is more than one SPF record an error? The specification requires a single v=spf1 record per domain. If two are published, receivers must treat SPF as a permanent error for that domain, so the records need merging into one.