What is the SPF 10 lookup limit?

Receivers evaluate at most 10 include, a, mx, ptr, exists and redirect terms across the whole SPF record, including the records it includes. One more is a permanent error, and DMARC treats that as an SPF failure for all of your mail.

Should my SPF record end in ~all or -all?

~all (soft fail) is the usual choice while you make sure every service that sends for you is listed; your DMARC policy then decides what happens to unlisted mail. -all (hard fail) is the stricter end state. ?all and +all protect nothing.

Can a domain have two SPF records?

No. With more than one record that starts with v=spf1, receivers return a permanent error and SPF fails. Merge them into one record with one all at the end.

Free tool

SPF record checker

Validate a domain's SPF record, count its DNS lookups across every include against the limit of 10, and get the exact fix for each problem.

Last updated 2026-10-21

Run it with curl

This tool is also a free API: no account, no key, CORS open. OpenAPI description.

curl "https://sendly.now/api/tools/spf-checker?domain=example.com"

# Markdown instead of JSON:
curl -H "Accept: text/markdown" "https://sendly.now/api/tools/spf-checker?domain=example.com"

How receivers read SPF

When mail arrives, the receiving server reads the SPF record of the return-path domain and checks whether the connecting server is listed, following every include, a and mx term to do it. The record has to parse, stay within 10 DNS-querying terms and 2 empty answers, and end in an all that says what to do with everything else.

What this checker counts

Every include, a, mx, ptr, exists and redirect term, across the whole include tree, the way receivers count them.
Lookups that return nothing (void lookups), which fail SPF past 2.
The qualifier on all, and terms SPF does not define.
Loops, includes of domains without an SPF record, and domains publishing two records.

More DNS tools

For the rest of a domain's DNS (finding the DNS provider, following CNAME chains, comparing records before and after a change), see the DNS tools by DoDomain.

Questions people ask

What is the SPF 10 lookup limit?: Receivers evaluate at most 10 include, a, mx, ptr, exists and redirect terms across the whole SPF record, including the records it includes. One more is a permanent error, and DMARC treats that as an SPF failure for all of your mail.
Should my SPF record end in ~all or -all?: ~all (soft fail) is the usual choice while you make sure every service that sends for you is listed; your DMARC policy then decides what happens to unlisted mail. -all (hard fail) is the stricter end state. ?all and +all protect nothing.
Can a domain have two SPF records?: No. With more than one record that starts with v=spf1, receivers return a permanent error and SPF fails. Merge them into one record with one all at the end.

Something on this page out of date, or missing the case you are in? Write to support@sendly.now — we answer our own email. The full technical detail lives in the documentation.