Skip to content
Inboxwise Tools

SPF Record Syntax Checker

Paste your SPF record to catch syntax mistakes, risky settings and lookup-limit problems before they hurt your email delivery.

Syntax check only. This tool reads the text you paste. It does not query DNS, so it can't see the records behind your include: entries or confirm that your record is actually published. Passing here does not guarantee inbox delivery.

Find it in your DNS settings: a TXT record on your domain that starts with v=spf1.

Try an example:

Results

Syntax

—

DNS-lookup terms (top level)

— / 10

Includes add their own lookups, which this tool can't see.

Policy for unlisted senders

—

Findings

    Record breakdown

    TermLookupWhat it does

    How an SPF record is structured

    An SPF record is a single TXT record on your domain. Receiving mail servers read it left to right and stop at the first term that matches the sending server's IP address.

    • v=spf1 — required version tag, always first.
    • Mechanisms — ip4, ip6, a, mx, include, exists, ptr and all. Each describes a set of allowed (or disallowed) senders.
    • Qualifiers — an optional prefix on a mechanism: + Pass (the default), - Fail, ~ SoftFail, ? Neutral.
    • Modifiers — redirect= (use another domain's SPF record) and exp= (custom failure explanation).
    • all — goes last and decides what happens to everyone else. ~all and -all are the common choices; +all authorizes the entire internet.

    The 10 DNS-lookup limit, explained

    To keep SPF checks fast, RFC 7208 limits how many DNS lookups an SPF evaluation may trigger. The terms that count are include, a, mx, ptr, exists and the redirect modifier. ip4, ip6 and all don't count.

    • The limit is 10 in total, and it includes lookups made inside every include: and redirect= target, all the way down. One include: for a large email provider can use several lookups by itself.
    • Going over the limit makes the whole check return a PermError, and many receivers treat that like a failure.
    • There is also a limit of 2 "void" lookups — lookups that return no records — which catches typos and expired includes.
    • Each mx or ptr lookup may resolve at most 10 host names.

    Because this tool doesn't query DNS, the number above is only your top-level count. If it's already 8 or more, it's very likely that the full count is over 10. To reduce lookups, remove services you no longer send from, replace a/mx with ip4/ip6 where your IPs are stable, and avoid ptr.

    Common SPF problems

    • Two SPF records. A domain must have exactly one TXT record starting with v=spf1. When you add a new email service, merge its include: into your existing record.
    • Typos in mechanism names. ip:, includes: or a missing colon makes the record invalid.
    • Terms after all. They are never evaluated.
    • Smart quotes or invisible characters copied from a document.
    • +all, which lets anyone send as your domain.

    SPF is one of three standards — with DKIM and DMARC — that mailbox providers use to decide whether your email is trustworthy. If you send newsletters, your email platform's setup guide will tell you which include: to add and how to set up DKIM for your domain.

    Once your authentication is in place, measure what happens next: tag your links with the UTM Builder and check engagement with the Open Rate Calculator.

    More free tools