SPF record checker

What SPF is

SPF is a TXT record on your domain listing the services allowed to send email for it. A typical record for a business on Microsoft 365 that also uses a mailing tool looks like this:

v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net -all

When an email arrives, the receiver checks whether the server that sent it is on your list.

The 10-lookup limit

Every include:, a, mx and redirect makes the receiver do a DNS lookup, and includes can contain more includes. SPF allows only 10 lookups in total. Go over and SPF fails for every email, even though the record looks fine.

The checker counts them for you, nested ones included. To get back under the limit, remove services you no longer use and swap includes for tools that can sign with DKIM instead.

~all vs -all

The end of the record says what to do with servers not on the list. ~all (soft fail) means "probably not us"; -all (hard fail) means "definitely not us". With DMARC in place, either works. -all is stricter, so use it once you're confident the list is complete. Never use +all, which allows anyone.

Multiple SPF records

A domain must have exactly one record starting v=spf1. Two records cause a permanent error, which counts as a fail. Merge them into one by combining the includes.

Quick fixes

1. Run the check and note the lookup count and any errors.
2. List every service that sends email as you.
3. Build one record that includes each service, ending in ~all or -all.
4. Replace the old record at your DNS host and run the check again.