Free SPF checker: validate and expand your SPF record
What is an SPF record?
SPF (Sender Policy Framework) is a DNS TXT record that specifies which IP addresses and mail servers are authorized to send email on behalf of your domain. When a receiving mail server gets an email claiming to be from your domain, it checks your SPF record to verify the sending server is on the allowed list.
A valid SPF record looks like this:
This record says: accept email from Google Workspace servers, SendGrid servers, the IP 203.0.113.10, and soft-fail everything else. The include: directives point to other SPF records that define the actual IP ranges — which is where most SPF complexity comes from.
For a full reference on SPF syntax, qualifiers, and provider setup examples, see the SPF record guide.
The SPF 10-lookup limit — the most common source of failures
SPF evaluation has a hard limit of 10 DNS lookups. Each include:, a:, mx:, and redirect= mechanism that resolves a DNS record counts toward this limit. When the limit is exceeded, the receiving server returns a permerror result — which many servers treat identically to a hard SPF fail.
This is a frequent silent problem. You add Google Workspace (1–2 lookups), then SendGrid (2–3 more), then Salesforce Marketing Cloud (3–4 more), then a transactional email provider, and before long you've exceeded the limit without realizing it. Email starts failing intermittently or gets flagged as spam.
DNS Buddy's SPF checker tracks cumulative lookup depth as it expands your record, and warns when you're at or near the limit.
What DNS Buddy's SPF checker shows you
Every include statement is resolved recursively. You see the complete tree of nested includes, not just the top-level record.
Each IP range is shown with CIDR notation and labeled with the provider it belongs to — Google, Sendgrid, Mailgun, etc.
The checker counts DNS lookups as it expands, warns when approaching 10, and flags permerror conditions.
ip4, ip6, a, mx, include, redirect, and exists are all parsed and displayed. The all qualifier (-, ~, +, ?) is highlighted.
The original TXT record string is shown alongside the expanded view so you can compare and verify.
Enter a domain, get results. Nothing to install, nothing to sign up for.
Common SPF record errors
Exceeded the 10-lookup limit. The receiving server stops evaluating and returns permerror. Fix: flatten your SPF record by replacing nested includes with explicit IP ranges, or use an SPF flattening service.
A domain must have exactly one SPF TXT record. Two records causes a permerror — receiving servers don't know which to use. Merge them into a single record.
An SPF record without an all mechanism at the end is incomplete. Use -all (hard fail) or ~all (soft fail) to handle unauthorized senders. +all allows any server to send — avoid it.
If a third-party sender (CRM, marketing tool, transactional email) isn't included in your SPF record, email from that service will fail SPF checks. Check which services send on your behalf and ensure their include is present.
What this SPF checker doesn't do
SPF is one layer of email authentication. DNS Buddy checks SPF thoroughly but doesn't cover the full email deliverability stack:
DNS Buddy checks SPF records only. It doesn't validate DKIM signatures or parse DMARC policies. For full DMARC/DKIM checking, tools like MxToolbox's Email Health checker cover all three layers. See how DNS Buddy compares to MxToolbox.
DNS Buddy doesn't connect to your mail server to test SMTP delivery. It analyzes DNS records only. For live SMTP tests, MxToolbox's SMTP test tool or similar services do this.
DNS Buddy doesn't predict whether your email will land in inbox or spam. That requires sending a test email and checking placement across providers — a different category of tool.
Frequently asked questions
How do I check my SPF record for free?
Go to DNS Buddy's SPF Analyzer, enter your domain, and click Check. No account or install required. The tool looks up your TXT record, expands all includes, and shows you the full IP list with provider labels.
What does "too many DNS lookups" mean for SPF?
SPF has a hard limit of 10 DNS lookups per evaluation. Exceeding it causes a permerror result, which most mail servers treat as a hard SPF fail. The most common cause: accumulating too many include: directives from multiple email service providers. The SPF Analyzer tracks and flags this.
What is the difference between SPF, DKIM, and DMARC?
SPF specifies which servers can send email for your domain. DKIM adds a cryptographic signature to verify the email content wasn't tampered with. DMARC ties them together and tells receiving servers what to do when SPF or DKIM fails (nothing, quarantine, or reject). All three are DNS records — SPF and DMARC are TXT records, DKIM adds a TXT record under a selector subdomain.
Check your SPF record now — free, no account needed
Enter a domain to see its fully expanded SPF record, resolved IP ranges, provider labels, and lookup depth.
Email authentication guides