Free tool
SPF record checker
Enter a domain. The checker reads the live SPF record, explains each mechanism, and counts DNS lookups against the limit of 10.
What SPF is
SPF is a TXT record at the domain that lists who may send mail for it. A receiver looks at the connecting server and walks the record. The record starts with v=spf1. Mechanisms name the allowed hosts. all says what happens to everyone else.
RFC 7208 section 4.6.4 limits the DNS-querying terms to 10. Those terms are include, a, mx, ptr, exists, and redirect. ip4 and ip6 do not ask DNS anything. The same section allows 2 void lookups, which are queries that return no answers. RFC 7208, section 4.6.4.
A cold-email domain often includes Google Workspace, Microsoft 365, and a sending tool. Each of those is an include that fetches another record, and that record spends lookups of its own. Three lines in your record can still pass 10 once the chains are added up. Past 10, a receiver stops and the result is an error, which can look like the mail was not authorized.
~all soft-fails mail that matched nothing earlier. That is the usual end for cold email while you confirm every sender is listed. -all fails that mail. Move to -all when the include set is stable. +all approves every host on the internet. Do not publish it. ?all asks receivers to treat unmatched mail as neutral.
Questions
What counts as an SPF lookup?
RFC 7208 section 4.6.4 counts include, a, mx, ptr, exists, and redirect. Each of those asks DNS a question. ip4, ip6, and all do not. A receiver stops after 10.
Why can three includes still pass 10 lookups?
Each include fetches another record, and that record has its own includes, a, and mx terms. Google Workspace, Microsoft 365, and a sending tool each bring a chain. The total of the chain is what has to stay at 10, not the number of includes you typed.
Should cold email use ~all or -all?
~all soft-fails mail that matched nothing earlier. It is the usual end while you confirm every sender is listed. -all fails that mail. Use -all once the include set is stable. Do not use +all.
What is a void lookup?
A void lookup is a DNS query that returns no answers. RFC 7208 allows two. A third makes the evaluation an error even when the lookup count is still under 10.
Does this checker send mail?
No. It reads TXT, MX, and address records. It does not see whether a receiver accepted a message.
Start with a free check, or the 14-day trial.