Validate your SPF record, see exactly how many of the 10 allowed DNS lookups each include uses, and get a fixed record you can paste into your DNS.
Checking SPF, DKIM, DMARC and MX records…
Live DNS lookups via Cloudflare DNS-over-HTTPS. Nothing is stored.
An SPF record is one TXT record at your domain's root that starts with v=spf1, lists who can send, and ends with what to do with everyone else.
| Term | What it does | Lookups |
|---|---|---|
| ip4:203.0.113.0/24 | Allow an IPv4 address or range | 0 |
| ip6:2001:db8::/32 | Allow an IPv6 address or range | 0 |
| include:_spf.google.com | Allow everything another domain's SPF allows | 1 + nested |
| a | Allow the IPs in the domain's A/AAAA record | 1 |
| mx | Allow the domain's mail servers | 1 |
| exists:%{i}.example.com | Advanced, macro-based check | 1 |
| redirect=_spf.example.com | Use another domain's SPF instead (only if no all) | 1 |
| ptr | Deprecated — don't use | 1 |
| ~all / -all | What to do with everything else (soft / hard fail) | 0 |
Qualifiers go in front of any term: + pass (default), ~ soft fail, - fail, ? neutral.
~all. Don't create a second SPF record.SPF: PASS.| Service | SPF include |
|---|---|
| Google Workspace | include:_spf.google.com |
| Microsoft 365 | include:spf.protection.outlook.com |
| Zoho Mail | include:zoho.com (EU: zoho.eu) |
| Mailchimp | include:servers.mcsv.net |
| SendGrid | include:sendgrid.net |
| Amazon SES | include:amazonses.com |
| Mailgun | include:mailgun.org |
| Brevo | include:spf.brevo.com |
| Proton Mail | include:_spf.protonmail.ch |
| Postmark | include:spf.mtasv.net |
Always confirm with your provider's documentation — some (HubSpot, Salesforce, Mimecast) use account- or region-specific values.
SPF limits a record to 10 mechanisms that need a DNS lookup: include, a, mx, ptr, exists and redirect. Includes count recursively, so include:_spf.google.com alone uses 4. Above 10, receivers return a permanent error (permerror) and treat SPF as failed, which can also make DMARC fail. ip4 and ip6 don't count.
First remove includes for services you no longer use — this is the most common cause. Then replace a and mx with the actual ip4: ranges of your servers. If you still need more, move a sending service (newsletter, CRM) to a subdomain like news.example.com with its own SPF record. SPF 'flattening' services also work, but they need maintaining when providers change their IPs.
If you have DMARC, use ~all (soft fail). DMARC makes the final decision either way, and ~all avoids some forwarding-related rejections before DMARC is evaluated. Use -all only if you're sure every sender is listed. Never use +all — it authorizes every server on the internet.
No. A domain must have exactly one TXT record starting with v=spf1. With two, receivers return a permanent error and SPF fails for every message. This often happens when a new service tells you to 'add this SPF record' — instead, merge their include into your existing record. This checker builds the merged record for you.
Not on its own. SPF checks the hidden envelope sender (Return-Path), not the visible From header. To protect the From address you need DMARC, which requires SPF or DKIM to pass for a domain that matches the From domain (alignment).
When a message is forwarded, the forwarding server sends it from its own IP, which isn't in your SPF record. That's normal and is why DKIM matters: a DKIM signature survives forwarding, so DMARC can still pass.
Free tools for network engineers — no signup, no rate-limit walls.