SPF record checker

What it checks

• The SPF record itself, and whether there is more than one (which makes SPF fail).
• Total DNS lookups across all nested includes, against the limit of 10.
• Void lookups: names that return nothing, against the limit of 2.
• Includes that have no SPF record, appear twice, or end in +all.
• The all qualifier (-all, ~all, ?all or +all) and the deprecated ptr mechanism.
• Which email services the record authorizes, such as Microsoft 365 or SendGrid.

How to read the result

Start with anything marked Fail: a missing record, two records, more than 10 lookups or a +all include each break SPF for every message. Warnings such as void lookups or duplicate includes are worth fixing before they become failures. The include tree shows where each lookup comes from, so you can see which provider costs the most.

Common SPF problems and fixes

Too many lookups usually comes from includes you no longer need, or from a provider adding nested includes. Remove unused services first, then consider moving some senders to a subdomain; flatten only as a last resort. Two SPF records must be merged into one. Never use +all or ?all to silence an error, because that lets anyone send as your domain.

Frequently asked questions

What is a good SPF record?

One record, under 10 lookups, listing only the services that send as your domain, and ending in ~all or -all. DKIM and DMARC should be set up alongside it.

Should SPF end in -all or ~all?

Both are acceptable when DMARC is enforced. -all is stricter; ~all is common and avoids rejecting mail outright if SPF has a temporary problem.

Why does my SPF record fail with permerror?

Usually more than 10 DNS lookups, more than 2 void lookups, or two SPF records. The checker shows which one.

Is the check free and private?

Yes. It's free with no sign-up, and the DNS queries go from your browser to Cloudflare's public resolver, not to ToolVeriq.