SPF record checker, merger and lookup counter
Read a domain's SPF record, count its DNS lookups against the limit of ten, catch the two-record permerror, and get a merged record you can publish.
An SPF record fails for one of three reasons: there are two of them, it needs more than ten DNS lookups, or it ends in +all. All three produce a permerror or a meaningless pass, and all three are silent — nothing bounces, mail just starts landing in spam. This tool checks all three and gives you the corrected record.
| Include | Lookups | Provider |
|---|---|---|
| include:_spf.google.com | 3 | Google Workspace |
| include:spf.protection.outlook.com | 2 | Microsoft 365 |
| include:sendgrid.net | 2 | SendGrid |
| include:mailgun.org | 2 | Mailgun |
| include:_spf.salesforce.com | 2 | Salesforce |
| include:servers.mcsv.net | 1 | Mailchimp |
| include:amazonses.com | 1 | Amazon SES |
| include:spf.mailhaap.com | 1 | MailHaap |
Why does my SPF record fail with “too many DNS lookups”?
SPF evaluation is capped at ten DNS lookups by RFC 7208, and every include, a, mx, ptr, exists and redirect mechanism counts — including the lookups performed inside the records you include. Google Workspace alone costs three; a typical stack of Google plus a marketing tool plus a support tool plus a CRM is already at eight. Once you cross ten, evaluation stops with a permerror and every SPF check fails, including the senders listed before the tenth lookup.
Can I publish two SPF records?
No. RFC 7208 allows exactly one SPF TXT record per domain. With two, receivers return permerror and every check fails — this is worse than having no SPF record at all, because it looks deliberate. The fix is always to merge the mechanisms into a single record, which is what the suggestion above does.
Should my record end in ~all or -all?
Use ~all (softfail) while you are still discovering which systems send as your domain — invoicing tools, CRMs, ticketing systems and the marketing platform someone signed up for two years ago. Move to -all (hardfail) once your DMARC aggregate reports show no legitimate sender failing alignment. Never use +all: it authorises every server on the internet.
What is SPF flattening and when should I use it?
Flattening replaces include mechanisms with the IP ranges they resolve to, collapsing several lookups into one. It works, but it breaks silently when a provider changes their IPs, so it must be maintained. If you need it, use a flattened include that someone keeps updated rather than pasting raw IP ranges into your own record.