One record
A domain may have only one v=spf1 record. Two is a common story after a newsletter service is added next to hosting: the recipient sees an error and checks neither.
SPF record checker
SPF tells recipients which servers may send mail for your domain. A mistake in it is a common cause of spam: two records instead of one, more than 10 DNS lookups or an ending that forbids nothing. We check the record and explain every finding.
Check SPF by domain name
We count DNS lookups including nested includes, the way a recipient does.
What we check in an SPF record
The 10-lookup limit
Every include, a and mx costs the recipient a DNS lookup, and nested includes count too. Past ten, the SPF check fails even if the record is otherwise correct.
The all ending
An ending of ~all reports a soft fail; -all says the server is not authorized to send. The recipient decides whether to deliver the message. +all authorizes everyone, while ?all makes no statement about authorization.
SPF questions
Two records, the 10-lookup limit and how the record ends.
Can I have two SPF records, one for hosting and one for newsletters?
No. A domain name must have a single v=spf1 record. Include every sender in it, both hosting email and your newsletter service. Two separate SPF records cause a validation error at the recipient. Use the SPF generator to combine senders, then check the result on this page after publishing it.
What does the 10 DNS lookup limit mean?
To check SPF, the recipient expands the record: every include:, a, mx, exists and redirect= is a DNS lookup, and nested includes inside included records count too. The standard allows at most ten; past that the check fails. Staying within it is simple: remove services you no longer use and replace a and mx with ip4: addresses, which cost no lookups.
Which is better at the end of SPF: ~all or -all?
~all returns a soft fail for servers outside the list; -all explicitly states that they are not authorized to send. The recipient decides whether to deliver based on its own rules and other checks. ~all is often used during setup; switch to -all after checking all senders. Neither replaces DKIM and DMARC configuration.
More tools: Domain email
Email settings checker
MX, SPF, DKIM, DMARC and blacklists in one go, scored out of nine.
OpenDKIM checker
Find a DKIM key in DNS and check its length and status.
OpenDMARC checker
Whether there is a record, which policy it sets and where reports go.
OpenMX lookup
The domain’s mail servers, their addresses, reverse DNS and encryption.
OpenBlacklist check
Check an IPv4 address or a domain’s mail server IPs against blacklists.
OpenSPF generator
Choose your mail senders to create an SPF record for DNS.
OpenDMARC generator
Choose how to handle messages and where to send DMARC reports.
OpenEmail on your own domain comes with hosting
On our hosting, mailboxes on your domain are part of the plan, and mail records are set up in the Plesk panel.
Keep domain records on reliable DNS
Host MX, SPF, DKIM and DMARC on our name servers: you edit records yourself at any time, the domain can stay with any registrar and mail with any provider.