How to Check Your SPF Record (and Fix Common Errors)
SPF tells receiving servers which hosts may send mail for your domain. Here is how to read your SPF record, the 10-lookup limit, and the mistakes that quietly break it.
On this page · 3 sections
If your mail is landing in spam, or bouncing with a vague authentication error, the first record to check is SPF. It is also one of the easiest to get subtly wrong, because a broken SPF record often still looks fine.
What SPF does
SPF (Sender Policy Framework) is a TXT record in your DNS that lists which servers are allowed to send mail using your domain. When a receiving server gets a message claiming to be from [email protected], it checks the sending server's IP against your SPF record. A match passes. A mismatch can mean spam folder, or a bounce.
A typical record looks like this:
v=spf1 include:_spf.google.com include:sendgrid.net ~allv=spf1marks it as an SPF record.include:pulls in another provider's allowed senders (Google, SendGrid, etc.).~allis a soft fail: anything not listed is suspicious but not rejected.-allis a hard fail: reject outright.
The mistakes that quietly break it
Two SPF records. A domain may have only one SPF record. Publish two and most servers treat the result as a permerror, which can fail everything. This usually happens when a new provider is added without merging into the existing record.
The 10-lookup limit. SPF allows a maximum of 10 DNS lookups when it resolves all those include: statements. Stack up enough providers and you blow past it, which is also a permerror. Each include can chain to more includes, so the count climbs faster than it looks.
Ending in +all. This authorizes the entire internet to send as your domain. It is the single most dangerous SPF mistake and effectively turns SPF off.
SPF on its own is not enough. It authenticates the envelope sender, not the visible From address. That gap is why DKIM and DMARC exist. But a broken SPF record will undermine both.
How to check it
You can pull the raw record with dig acme.com TXT +short and read it by hand, but you still have to count the lookups and spot a second record yourself.
The free SPF checker fetches your record, counts the DNS lookups against the limit of 10, flags a second record or a +all, and shows you the raw TXT so you can see exactly what receiving servers see. It does not save the domain you check.
SPF is one of three records that work together. Check the other two with the DKIM checker and the DMARC checker, or read the full SPF, DKIM, and DMARC setup guide.
Start with 500 free validation credits. No credit card.
Both Free and Pro run the same scan engine — full SMTP probe, MX lookup, typo, disposable, domain checks, and the evidence chain on every verdict. The difference is the monthly credit pool (Free=500, Pro=100,000) plus Pro's API and MCP access.