More than one SPF record
Merge them: one record, one v=spf1, every include in it.
Tools · 30 seconds
SPF record checker
Look up a domain’s SPF record, follow every include and count the DNS lookups against the limit of 10.
Runs in your browser · public DNS records only · nothing stored
What an SPF record does
An SPF record is a TXT record on your domain that lists which servers may send email for it. A receiving server compares the sending server with that list. If it is not there, the email is flagged or rejected, depending on how your record ends.
Each tool that sends as you, such as your mailbox provider, newsletter tool or CRM, needs to be in the same single record, usually as an include.
How the 10-lookup limit works
- CountEvery include, a, mx, ptr, exists and redirect costs one DNS lookup, including those inside the includes.
- LimitAbove 10 lookups, SPF returns a permanent error and fails for every email.
- Read the treeThe result shows every include and what it costs, so you see which tool uses the most.
- FixRemove tools you no longer use first. Replace a and mx with ip4 ranges where your servers are fixed.
SPF record syntax
| Part | Example | Meaning |
|---|---|---|
v=spf1 | v=spf1 | Start of every SPF record. Exactly one per domain. |
include: | include:_spf.google.com | Allow the servers listed in another domain’s SPF. Costs 1 lookup, plus its own. |
ip4: / ip6: | ip4:203.0.113.10 | Allow one address or range. Costs no lookups. |
a / mx | mx | Allow the servers in your A or MX records. 1 lookup each. |
redirect= | redirect=_spf.example.com | Use another domain’s SPF instead. 1 lookup. |
-all | -all | Reject email from servers not listed. |
~all | ~all | Flag email from servers not listed (soft fail). The usual start. |
?all / +all | +all | Neutral, or allow everyone. Avoid both. |
Common SPF errors and fixes
Too many DNS lookups
Remove old tools; avoid nested includes you do not need.
Missing all at the end
End with ~all, or -all once every sender is listed.
+all
Lets anyone send as you. Replace with ~all.
Include that no longer exists
A void lookup. More than 2 makes SPF fail. Remove it.
ptr mechanism
Slow and discouraged by the SPF standard. Replace with ip4 or include.
Gmail and Yahoo sender rules
What inbox providers require since February 2024
Bulk senders send about 5,000 or more emails a day to Gmail. Cold email teams reach that quickly across mailboxes, so treat the bulk rules as the standard.
Source: Google email sender guidelines
| Rule | Who | Requirement |
|---|---|---|
| SPF or DKIM | All senders | Required |
| SPF and DKIM | Bulk senders | Required |
| DMARC, p=none or stronger | Bulk senders | Required |
| From domain aligned with SPF or DKIM | Bulk senders | Required |
| One-click unsubscribe | Bulk senders, marketing email | Required |
| Spam complaint rate | All senders | Below 0.3 percent |
Questions people ask
How do I check my SPF record?
Enter your domain above. The checker reads the TXT records on the domain, finds the one that starts with v=spf1, follows every include and counts the lookups.
Can a domain have two SPF records?
No. With two or more records starting v=spf1, SPF returns an error and fails. Merge them into one.
Should I use -all or ~all?
Start with ~all while you confirm every tool is listed, then move to -all if you want strict rejection. With DMARC in place, ~all is common and accepted by the large inbox providers.
Does SPF alone stop spoofing?
No. SPF checks the hidden envelope sender, not the From address people see. DMARC links the two, which is why you need DMARC as well.
Is my domain stored?
No. The check runs in your browser. Your browser asks Cloudflare’s public DNS service (or Google’s, as a fallback) for the domain’s public records, the same records every mail server reads. RevOps Lab does not receive or store the domain or the result.