SPF checker: count every lookup, not just the record.
An SPF check may make at most 10 DNS lookups (RFC 7208, section 4.6.4), and the lookups inside every include count toward that limit. Past 10, receivers return a permanent error and SPF fails for every message. This checker walks every include and redirect and counts the whole tree.
Ten lookups, counted across the whole tree.
RFC 7208 allows an SPF evaluation ten terms that query DNS: include, a, mx, ptr, exists and redirect. The ones inside each include count too, so one line for a mail provider can cost three or four. Go past ten and receivers return a permanent error, which fails SPF for every message, including the legitimate ones.
The usual fix is to remove services you no longer send through, then check what is left. Build a replacement with the SPF record generator, or check the whole domain, DKIM and DMARC included, with the domain checker.
Frequently asked questions.
RFC 7208 allows one SPF evaluation at most 10 terms that cause a DNS query: include, a, mx, ptr, exists and redirect. Lookups inside each include count toward the same total. Past 10, receivers return a permanent error (permerror) and SPF fails for every message from the domain.
For the full walkthrough, see the SPF setup guide.
DMARC Report Analyzer
Paste or upload a DMARC aggregate (RUA) report and see total volume, pass/fail rates, and which senders are failing. Runs in your browser.
DMARC Record Generator
Create a valid DMARC record for your domain. Configure policy, reporting emails, and advanced options.
SPF Record Generator
Build an SPF record to authorize your email senders. Includes common services and DNS lookup counter.
Domain Checker
Check your domain's email authentication setup. See your SPF, DKIM, DMARC, and MTA-STS configuration.
DMARC Checker
Look up any domain's DMARC record and get every tag explained — policy, alignment, reporting, and coverage.
DKIM Checker
Check a domain's DKIM record by selector. See the key type, size, and each tag, with quick-picks for common providers.
MTA-STS & TLS-RPT Checker
Check a domain's MTA-STS policy record and TLS-RPT reporting — the pair that forces inbound mail over TLS.
BIMI Checker
Look up a domain's BIMI record, preview the logo, and confirm the VMC and DMARC enforcement it requires.
A passing record is not the same as aligned mail.
SPF only counts for DMARC when the authorized domain matches the From: address. Aggregate reports show, sender by sender, whether that happens. Monitor collects and reads them for 2 domains at no charge.