SPF Record Checker
Check the live SPF record of a domain: syntax, the 10-DNS-lookup limit, include tree and the all policy. This live check sends only the domain name you enter to Google Public DNS (or Cloudflare DNS as a fallback) over HTTPS; nothing is sent to ToolkitPoint.
How to use SPF Record Checker
- Type a domain or an email address, such as example.com or you@example.com.
- Press "Check SPF".
- Read the record, the lookup count out of 10 and the ending all policy.
- Open the include tree to see which provider uses how many lookups, and fix any items marked in red.
Worked example
Check google.com. The tool shows the published v=spf1 record, walks each include to build a tree, and reports how many of the 10 allowed DNS lookups the whole chain uses and whether it ends in ~all or -all.
When to use this tool
- Fixing email that lands in spam after adding a new sending service.
- Checking a client's SPF setup before a migration to Google Workspace or Microsoft 365.
Important limitations
Macros such as %{i} are not expanded, and a:/mx: targets are counted but not fully resolved to IP addresses.
Frequently asked questions
What is the SPF 10-lookup limit?
RFC 7208 lets receivers perform at most 10 DNS lookups while checking SPF. include, a, mx, ptr, exists and redirect each count, including those nested inside includes. Above 10, SPF returns a permanent error and fails.
Should I use ~all or -all?
Both protect you. -all asks receivers to reject unlisted servers; ~all marks them as suspicious and is the common choice while DMARC does the enforcing. Never use +all, which lets anyone send as your domain.
Can a domain have two SPF records?
No. Two v=spf1 records are a permanent error, and receivers ignore both. Merge them into one record.
What is a void lookup?
A lookup that finds no records, for example an include of a domain that no longer exists. More than two void lookups can also make SPF fail.
Is this a live check?
Yes. The records are read from public DNS at the moment you press the button, through Google Public DNS or Cloudflare. Only the domain name is sent.