Free SPF checker
A valid SPF, under the 10-lookup limit.
An SPF record that exceeds ten DNS lookups returns a PermError and stops protecting the domain. This checker unrolls the includes, counts the lookups and points out the heaviest terms.
- Free
- No account
- Instant result
- Public data only
Analyze a domain
How it works
- 1
Enter a domain
Enter the domain to analyze. No account, no proof of ownership: the analysis reads only public DNS data.
- 2
Public DNS is read
The checker fetches the SPF record, unrolls every include and redirect, and counts the real DNS lookups.
- 3
Instant verdict
A clear verdict and the detailed findings appear on screen. A free account then lets you monitor changes over time.
Why it matters
An SPF record broken by too many lookups weakens DMARC alignment and makes domain spoofing easier: legitimate messages can be rejected, fraudulent ones can pass. Fixing the record — by reducing includes or flattening it — restores a healthy authentication baseline.
PermError = SPF ignored
Beyond ten DNS lookups, evaluation stops with a PermError: SPF protects nothing anymore.
Spoofing made easier
A broken SPF weakens DMARC alignment; fraudulent messages pass in the domain’s name.
Legitimate email rejected
A failing record sends legitimate messages to spam, or gets them refused.
The 10 DNS-lookup limit
SPF (RFC 7208) allows a maximum of ten DNS lookups to evaluate a record. Each include, a, mx, ptr, exists and redirect mechanism consumes one — and a single include can trigger many more in cascade. Beyond ten, evaluation stops with a PermError: SPF is ignored, as if it did not exist.
Worth remembering — One SPF record per domain, ideally ending in “-all”. To stay under the limit: reduce includes or flatten the record.
How the checker works
The checker reads the domain’s public SPF record, then recursively unrolls each include and redirect to count the real DNS lookups. It reads only public DNS data — no server on the domain is probed, and no ownership or consent is required. The result details the lookup count, the configuration findings and the weight of each term.
Frequently asked questions
- Does the analysis pose any risk to the domain?
- No. The checker reads only public DNS records; it connects to no server on the domain and changes nothing.
- What does the ten DNS-lookup limit mean?
- The SPF standard stops evaluation beyond ten DNS lookups and returns a PermError. The record is then ignored: reducing the number of includes or flattening the SPF resolves it.
- Is an account required to analyze a domain?
- No, the analysis is free and immediate. A free account is only needed to monitor changes over time and to get a full DMARC report.