Formula and assumptions
SPF: RFC 7208 (max. 10 DNS lookups) · DMARC: RFC 7489 (_dmarc.domain)Check a domain’s SPF and DMARC: errors, policy and the 10 DNS lookup limit. Uses public DNS from your browser; DKIM is not checked.
SPF and DMARC checker
Check whether your email is protected against spoofing.
SPF and DMARC checker
Fields contain editable examples.
How many DNS lookups can an SPF record use?
An SPF record allows at most 10 DNS lookups: include, a, mx, ptr, exists and redirect count, including those inside each include. Above that, SPF fails with permerror. ip4, ip6 and all use no lookups.
Calculation assumptions
Check a domain’s SPF and DMARC: errors, policy and the 10 DNS lookup limit. Uses public DNS from your browser; DKIM is not checked.
How to use this calculator
Check whether your domain is protected against spoofing and whether your mail meets the sender requirements of Gmail, Yahoo and Microsoft. The tool reads the domain SPF and the DMARC record at _dmarc, follows each include to count DNS lookups and tells you what to fix. DKIM is not checked because it needs the selector.
Worked example
- Example record: v=spf1 include:_spf.google.com include:servers.mcsv.net mx ~all.
- Each include and the mx mechanism count one lookup: 3 in this record, plus any inside each include.
- ~all flags mail from unlisted servers as suspicious; -all rejects it.
Example result
- SPF DNS lookups
- 3
- all mechanism
- ~all
Interpreting the result
Fix errors first: without SPF or with two SPF records, receivers cannot validate your mail. Above 10 lookups, remove includes you no longer use or list IP ranges with ip4 and ip6. For DMARC, start with p=none and an rua address to receive reports, review who sends as your domain, then move to quarantine and later reject.
Frequently asked questions
Can I have two SPF records?
No. If a service asks you to add its SPF, merge its include into your existing record: v=spf1 include:one include:two ~all.
What is the difference between ~all and -all?
~all (softfail) accepts the mail but flags it as suspicious; -all (fail) asks receivers to reject it. With DMARC enforced, ~all is usually enough.
Why is DKIM not shown?
DKIM is published at selector._domainkey.domain and the selector depends on each provider. You can see it with the DNS lookup, type TXT.