What is the SPF 10 DNS lookup limit?

RFC 7208 caps the mechanisms that require DNS lookups (include, a, mx, ptr, exists and the redirect modifier) at 10 per check, counted across all nested includes. Exceeding it returns permerror and receivers treat your record as broken, so mail can fail authentication silently.

What is the difference between ~all and -all?

-all (fail) tells receivers to reject mail from sources not listed in the record. ~all (softfail) marks it suspicious instead, which most receivers score rather than reject. ?all is neutral and offers no protection, and +all allows the whole internet to send as your domain.

Why should I avoid the ptr mechanism?

ptr is deprecated by RFC 7208: it is slow, unreliable and burns DNS lookups against the 10-lookup limit. Replace it with ip4/ip6 blocks or an include of your provider.

SPF Record Validator

SPF record to validate

Or paste a record above. Fetching also resolves nested include: chains to count DNS lookups against the limit of 10.

Include chain (lookups per record)

What this validator checks

The record is parsed term by term the way a receiver does: the v=spf1 version tag, every mechanism (ip4, ip6, a, mx, include, exists, ptr, all) with its qualifier, and the redirect and exp modifiers. IP blocks are syntax-checked, deprecated ptr is flagged, unknown terms and text after all (which receivers ignore) are reported.

The part most tools skip: when you fetch a live record, the validator follows every include: and redirect= recursively and adds up the DNS lookups of the whole chain. RFC 7208 allows at most 10; going over means permerror and silently broken authentication, which typically happens after adding one SaaS provider too many. The meter shows exactly how much headroom is left and which include spends it.

SPF is one third of email authentication. Validate the matching DMARC policy with the DMARC Validator or check SPF, DKIM and DMARC of a domain at once with the Email Security Checker.