SPF record checker
Checks the record exists, counts the DNS lookups against the limit of ten, flags malformed mechanisms, and tells you what the trailing policy actually does.
What SPF does
SPF publishes a list of the servers allowed to send mail for your domain. A receiving server compares the sending IP against that list. It is one TXT record at your domain root, and it is the cheapest anti-spoofing measure available.
The ten lookup limit
Every include, a, mx, ptr, exists and redirect costs a DNS query, and RFC 7208 caps the total at ten — including the lookups inside records you include. Go past it and the result is permerror, which most receivers treat as no SPF at all. This is the most common way a correct-looking record stops working: a provider you include adds to their own record and breaks yours.
~all or -all
The trailing mechanism says what to do about senders not on the list. -all is a hard fail and the strongest setting. ~all is a soft fail: accept but mark. +all authorises the entire internet and is worse than publishing nothing. Start at ~all and move to -all once you are sure every legitimate sender is listed.
Authentication set up for you
Add a domain in Pigeonify and we generate the SPF, DKIM and DMARC records, then verify them for you. Free up to 5,000 emails a month.
Start free