Free tools
SPF record checker
Paste a domain and see its SPF record parsed: every mechanism, the policy for unlisted senders, every include and redirect walked, and the DNS lookup count against the limit of 10. Findings carry a severity, and a lookup that did not complete is said so — never hidden.
What is counted
Each include:, a, mx, ptr, exists: and redirect=term costs one lookup, and every included domain's record is walked the same way, so the count is the total a receiver would perform. ip4:, ip6: and all cost nothing. The checker reads TXT records through the system resolver; it does not evaluate a particular sender IP.
Frequently asked questions
What is the SPF ten-lookup limit?
RFC 7208 §4.6.4 caps the mechanisms that need a DNS query (include, a, mx, ptr, exists, and the redirect modifier) at 10 per evaluation, counted recursively through every include. A record over the limit returns permerror at receivers, which most treat like a failed check — so a domain can break its own mail by adding one more third-party include.
What is the difference between -all, ~all and ?all?
-all (hard fail) tells receivers to reject mail from senders the record does not list; ~all (soft fail) tells them to accept but mark it, which is what DMARC-aligned setups usually publish; ?all (neutral) makes no statement, so it gives DMARC nothing to align with; +all authorises every sender and defeats the purpose of the record.
Why does the checker say partially checked?
A DNS read the analysis depended on — the domain's own TXT, or an included domain's — did not complete. The tool then reports what it could read, prints the lookup count as a lower bound, and refuses to call the record valid, because a clean result from partial data would be a guess.
Does this fix my SPF record?
No; it tells you what is wrong and where. Common fixes: publish exactly one v=spf1 record, remove ptr, replace an include that itself includes many domains with the IP ranges it resolves to, and end with ~all or -all rather than ?all or nothing.
More free tools
- DNS provider detector
Which DNS host serves a domain, and whether one-click setup is available there.
- DNS propagation checker
One record, read from the authoritative nameservers and three public resolvers.