Free SPF checker
An SPF record that exceeds ten DNS lookups returns a PermError and stops protecting the domain. This checker unrolls the includes, counts the lookups and points out the heaviest terms.
The 10 DNS-lookup limit
SPF (RFC 7208) allows a maximum of ten DNS lookups to evaluate a record. Each include, a, mx, ptr, exists and redirect mechanism consumes one — and a single include can trigger many more in cascade. Beyond ten, evaluation stops with a PermError: SPF is ignored, as if it did not exist.
How the checker works
The checker reads the domain’s public SPF record, then recursively unrolls each include and redirect to count the real DNS lookups. It reads only public DNS data — no server on the domain is probed, and no ownership or consent is required. The result details the lookup count, the configuration findings and the weight of each term.
Why it matters
An SPF record broken by too many lookups weakens DMARC alignment and makes domain spoofing easier: legitimate messages can be rejected, fraudulent ones can pass. Fixing the record — by reducing includes or flattening it — restores a healthy authentication baseline.
Frequently asked questions
- Does the analysis pose any risk to the domain?
- No. The checker reads only public DNS records; it connects to no server on the domain and changes nothing.
- What does the ten DNS-lookup limit mean?
- The SPF standard stops evaluation beyond ten DNS lookups and returns a PermError. The record is then ignored: reducing the number of includes or flattening the SPF resolves it.
- Is an account required to analyze a domain?
- No, the analysis is free and immediate. A free account is only needed to monitor changes over time and to get a full DMARC report.