Free email security tool
Select the services that send email for your domain. You get a single SPF TXT record, a DNS lookup count against the 10-lookup limit, and a warning before the record breaks.
Create a TXT record at the domain itself (often shown as @) with the value above. If the domain already has a record starting with v=spf1, replace it: two SPF records cause a permanent error and SPF fails for all mail.
Receivers stop after ten DNS lookups. Every include, a and mx counts, and includes open further lookups inside the provider's record. A record that looks short can still exceed the limit, which is why this page shows a minimum and the checker shows the real total.
It does not look at your domain or your mail flow, so it cannot know which services send mail for you. A sender you forget to list will fail SPF. DMARC aggregate reports are the reliable way to find every sender.
Add your domain to CloudSpex to monitor SPF, DKIM and DMARC continuously and get alerted when the record changes or the lookup limit is exceeded.
Start Monitoring FreeReceivers stop evaluating SPF after ten DNS lookups and return a permanent error. Each include, a, mx, exists and redirect counts; ip4 and ip6 do not. Includes can trigger further lookups inside the provider's own record, so the real total is often higher than what you see in your own record.
-all tells receivers to fail mail from any source not listed. ~all marks it as a soft fail, which most receivers accept. Use ~all while you are still discovering senders and -all once the list is complete.
No. A domain must publish exactly one TXT record that starts with v=spf1. Two records cause a permanent error and SPF fails for all mail. Merge all senders into a single record.
No. It builds the record from what you select. To see the lookups your published record really triggers, including those inside each include, use the SPF Record Checker.