[ Free tool · Email Authentication ]

SPF Checker

Validate your SPF record and check the 10-lookup limit.

[ About this tool ]

This SPF checker fetches your v=spf1 record, expands every include recursively and counts DNS lookups against the RFC 7208 limit of 10.

How to read the results

  • ›Over 10 lookups returns PermError and SPF fails everywhere.
  • ›Two v=spf1 records is also a PermError.
  • ›+all authorizes the whole internet and must be removed.
  • ›~all or -all at the end is expected.

Frequently asked questions

How do I check my SPF record?

Enter your domain. The tool shows the record, each include tree and the total lookup count.

What does SPF PermError mean?

The record is invalid: usually too many DNS lookups, multiple SPF records or a syntax error.

How do I fix too many SPF lookups?

Remove services you no longer use, replace include: with ip4:/ip6: where stable, or use an SPF flattener.

Learn more in our guide: SPF (Sender Policy Framework)

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

[ More tools ]

SPF Generator

List your sending sources and generate a correct v=spf1 record.

SPF Flattener

Turn includes into IP ranges to get under the 10-lookup limit.

SPF CIDR Calculator

Work out an IP range and the exact ip4:/ip6: SPF mechanism.

Full Domain Health Scan

Run every email security check at once and get one score.

DMARC Checker

Look up and explain any domain's live DMARC record.

DKIM Lookup

Verify a DKIM selector is published and the key is valid.