Skip to main content
MailFleet

Free tools

SPF checker — validate SPF records & DNS lookup count

Enter the domain you send mail from to validate SPF TXT records, authorized mechanisms, syntax issues, and the 10-lookup limit before configuring providers in MailFleet.

Back to content tools

At a glance

What it is
DNS-based SPF validator with TXT record parsing, mechanism breakdown, lookup counter, and fix recommendations.
Who it is for
Email marketers, DNS admins, and MailFleet users configuring SMTP/API providers.
Main capabilities
SPF discovery, syntax checks, 10-lookup counter, mechanism table, MX/A context, captcha, rate limits.
Platforms
Browser-based diagnostic on mailfleet.app with server-side DNS checks when the live service is available.
Responsible use
Checks DNS publication only. Compare authorized IPs to your provider documentation before sending.

SPF DNS validation

Query TXT records, parse mechanisms, and count DNS lookups. Captcha required.

Sending domain

Security verification

Required to prevent automated abuse of the public DNS checker.

Verification challenge

Capabilities

Validate SPF before you send

Catch duplicate records, lookup overflows, and weak all policies before they break authentication in production.

  • SPF TXT discovery

    Finds v=spf1 records on your sending domain and flags missing or duplicate SPF entries.

  • Mechanism breakdown

    Lists include, ip4, ip6, mx, a, and all mechanisms with qualifier policy (pass, fail, softfail).

  • 10-lookup counter

    Counts DNS lookups from nested include chains — exceeding 10 causes PermError and SPF failure.

  • Syntax & policy warnings

    Detects +all, missing all, deprecated ptr, and multiple SPF records.

  • MX & A context

    Shows MX hosts and A records for the domain to help verify mx and a mechanisms.

  • Abuse-resistant

    Image captcha, session verification, and per-IP rate limits for public use.

How to use

Five steps to a valid SPF record

  1. 1

    Enter sending domain

    Use the domain in your From address (e.g. yourdomain.com), not your website unless they match.

  2. 2

    Solve captcha

    Complete the image challenge before running the DNS check.

  3. 3

    Review SPF record

    Confirm a single v=spf1 TXT record and read the parsed mechanisms.

  4. 4

    Check lookup count

    Ensure nested includes stay at or below 10 DNS lookups.

  5. 5

    Fix & re-test

    Update DNS, wait for propagation, then run the check again.

What is an SPF record?

Sender Policy Framework (SPF) is a DNS TXT record that lists which mail servers may send email for your domain. Receiving servers compare the connecting IP against your SPF policy during authentication.

SPF is defined in RFC 7208. It works alongside DKIM and DMARC — SPF alone does not guarantee inbox placement, but missing or broken SPF hurts alignment and trust.

Why the 10 DNS lookup limit matters

Each include:, a, mx, exists, and ptr mechanism can trigger DNS lookups. Nested include records add to the total. More than 10 lookups causes PermError — SPF fails entirely.

High lookup counts often come from multiple ESP includes. Consolidate providers, remove unused includes, or use SPF flattening when you approach the limit.

  • include: adds 1 lookup plus nested lookups in the included domain
  • redirect= replaces the record and follows lookups in the target domain
  • Only one SPF TXT record is valid per domain

What this tool does not do

This checker validates DNS publication and SPF structure. It does not send test email or verify that your MailFleet provider IP is authorized — compare ip4 and include targets to your provider documentation.

DNS propagation can take minutes to 48 hours after changes. Re-test after TTL expires if results look stale.

Key takeaways

  • Only one v=spf1 TXT record is allowed per domain.
  • Nested include: chains count toward the 10 DNS lookup limit.
  • Use -all or ~all — avoid +all for production sending.
  • Validate DKIM and DMARC alongside SPF for full authentication.

For regulatory context on commercial email in the United States, see the FTC CAN-SPAM compliance guide.

Delivery note: MailFleet helps users manage campaigns through their own sending providers. Delivery outcomes depend on sender reputation, DNS authentication, content quality, recipient engagement, list quality, provider rules, and mailbox filtering systems.

SPF checker FAQ

RFC 7208 allows a maximum of 10 DNS lookups. Exceeding this causes PermError and SPF authentication failure.

Get started

Send with aligned SPF, DKIM, and DMARC

MailFleet helps you configure providers and validate authentication before campaigns go out.

Download MailFleetSMTP & API providers

Available on

  • Windows 10+
  • macOS 12+
  • Linux (DEB & RPM)

Same desktop experience across every platform — one workflow for your entire team.