SPF Checker with DNS Lookup Counter
Validate your SPF record and count its DNS lookups against the 10-lookup limit that causes PermError. We resolve every include recursively and show where the budget goes.
Result for 0663.biz
No SPF record
No v=spf1 TXT record is published on the root domain. Mail claiming to be from this domain cannot be SPF-authenticated.
FAQ
What does SPF do?
It tells receiving mail servers which senders are authorized for your domain.
What is an SPF PermError?
A permanent error returned when an SPF record is invalid, for example when it needs more than 10 DNS lookups or has more than 2 void lookups. Most receivers treat PermError as an authentication failure.
Why does the 10-lookup limit matter?
Each include, a, mx, ptr, exists and redirect term costs one DNS lookup, counted recursively through every include. Past 10, SPF stops evaluating and fails. Flatten includes or remove unused providers to stay under the limit.
Should I have more than one SPF record?
No, you should publish a single SPF record on the root domain. Two v=spf1 records cause PermError.
What is the difference between ~all and -all?
~all is softfail, -all is hard fail (recommended once configuration is correct).
Why is SPF valid but emails still go to spam?
You also need DKIM and DMARC alignment, plus good sending reputation.
How long does SPF change take?
Depends on DNS TTL and caches, usually minutes to hours.
What is SPF?
SPF is a TXT record like v=spf1 ... that tells receiving mail servers which IPs/providers are allowed to send emails for your domain.
Examples
- v=spf1 a mx -all - allow servers from A and MX records; deny all others.
- v=spf1 include:_spf.google.com -all - Google Workspace sending only.
- v=spf1 include:spf.protection.outlook.com -all - Microsoft 365 sending only.
Common mistakes
- Multiple SPF records on the same domain (should be one).
- Too many DNS lookups (SPF has a 10-lookup limit).
- Using ~all forever (softfail) instead of tightening to -all once ready.