Skip to content
Free planPink Post has a Free plan, free for good. No card needed.See plans: Free $0, Solo $19, Pro $39, Agency $129
Pink Post
Start free

Email & deliverability

SPF record checker

Enter a domain to fetch its SPF record, check the syntax, follow every include: and count the DNS lookups against the limit of 10. You also see the full include tree, so you can tell which service is eating your lookup budget.

Free, no signup. Results appear here.

On this page
  1. What an SPF record is
  2. The 10 DNS lookup limit
  3. ~all, -all, ?all and +all
  4. Other errors this tool flags
  5. SPF for outreach mailboxes
  6. FAQ

What an SPF record is

SPF (Sender Policy Framework, RFC 7208) is a TXT record at the root of your domain that lists the servers allowed to send mail for it. A receiving server looks up the record, checks whether the connecting IP is listed and gets a result: pass, fail, softfail, neutral or an error.

A record looks like v=spf1 include:_spf.google.com include:sendgrid.net ~all. It starts with v=spf1, lists mechanisms such as ip4:, include:, a and mx, and ends with an all rule for everything else.

The 10 DNS lookup limit

Each include, a, mx, ptr, exists and redirect costs one DNS lookup, and includes inside includes count too. RFC 7208 caps the total at 10. Go over and receivers return PermError, which most treat as an SPF fail for every message you send. It is a very common SPF problem, because every new tool (CRM, help desk, newsletter, outreach platform) asks you to add another include.

This checker walks the whole tree and shows the count. ip4: and ip6: do not cost lookups, so listing rarely-changing ranges directly is one way to get under the limit.

~all, -all, ?all and +all

~all (softfail) marks unlisted senders as suspicious and is the usual choice. -all (fail) is stricter and safe once every sender is listed. ?all is neutral and gives no protection. +all authorises the whole internet to send as you, so fix it immediately. With DMARC in place, ~all and -all behave much the same in practice.

Other errors this tool flags

  • Two SPF records: a domain may have only one. Two cause PermError. Merge them.
  • Void lookups: includes that return nothing. More than two is an error.
  • ptr: deprecated and slow; remove it.
  • Duplicate includes: waste lookups.
  • Unknown terms: typos like inlcude: break the record.

SPF for outreach mailboxes

If you send pitches from Google Workspace or Microsoft 365, the provider include is usually all you need. Pink Post sends through your own mailbox, so you do not add an include for Pink Post itself. Check SPF on every domain you send from, including any secondary domains you set up to protect your main brand.

More free tools

Related tools

Email deliverability test

email deliverability test.

SPF, DKIM & DMARC checker

Check SPF, DKIM, DMARC and MX for any domain in one test.

DMARC checker

DMARC record checker.

DKIM checker

DKIM record lookup.

MX lookup

MX record lookup.

Email blacklist checker

email blacklist checker.

FAQ

Questions, answered

How do I check my SPF record?

Enter your domain above. The tool fetches the TXT record that starts with v=spf1, validates it and counts lookups.

How many includes can SPF have?

There is no limit on includes as such, but the whole record, including nested includes, may use at most 10 DNS-querying mechanisms.

Should I use ~all or -all?

~all is the safe default. Move to -all once you are sure every legitimate sender is listed, ideally with DMARC reports confirming it.

Does SPF protect the From address people see?

Not on its own. SPF checks the envelope sender (Return-Path). DMARC is what ties the result to the visible From domain.

How long do SPF changes take?

Usually minutes, but resolvers may cache the old record for up to its TTL, often an hour.

Put these checks to work in Pink Post.

Free plan, no card. Connect your mailbox, import prospects and send link-building outreach with caps, warm-up, reply handling and live link checks built in.

Start free Compare plans