Find SPF failures systematically
Check SPF: one record, every sender, at most ten lookups.
Finding an SPF record is only the start. It must authorize every legitimate source, remain syntactically valid, and stay below the hard DNS-lookup limit.
Reviewed: July 19, 2026 · Primary sources below
Find exactly one SPF record
SPF is published as a TXT record at the sending domain and begins with v=spf1. More than one matching record produces permerror, so combine authorized sources in one policy.
Inventory every real sender
Include the mail platform, newsletter, CRM, billing software, website, scanner, ticketing, and outside providers. A new service needs SPF authorization or aligned DKIM.
Read mechanisms from left to right
SPF evaluates mechanisms in order. include, a, mx, exists, and redirect can trigger more DNS queries; ip4 and ip6 do not. End the policy deliberately with an all mechanism.
Count the lookup chain
SPF limits evaluation-time DNS lookups to ten. Exceeding the limit returns permerror. Nested includes count and can grow when a provider changes its own record.
Choose the ending deliberately
~all signals softfail and -all a hard fail for unauthorized sources. Do not switch blindly to -all while the sender inventory is incomplete. Google uses softfail in its Workspace-only example.
v=spf1 include:_spf.google.com ~allConfirm with real mail and DMARC
Inspect Authentication-Results on delivered messages. SPF authenticates the technical envelope domain; for DMARC it must align with the visible From domain unless aligned DKIM passes.
Important
SPF flattening is not an automatic long-term fix.
Replacing includes with today's IP addresses can reduce lookups but transfers maintenance to you. Provider infrastructure changes can make the static record obsolete. Prefer fewer sending platforms, aligned DKIM, and controlled provider mechanisms.
If you need continuous monitoring
See who really sends in your name.
DMARCTrust is an external platform for DMARC reports, alerts, and sender inventory. Its free evaluation tier is limited to one domain; paid business plans start at $19/month for two domains. The MX Audit score remains independent.
Can a domain have two SPF records?
No. If DNS returns more than one matching v=spf1 record, RFC 7208 requires permerror. Combine every mechanism in a single record.
What counts toward the ten-lookup limit?
include, a, mx, ptr, exists, and redirect trigger DNS work and count. Nested includes are evaluated too. ip4, ip6, and all do not count toward this limit.
Is SPF enough without DKIM and DMARC?
No. SPF authenticates a technical sender identity and can break during forwarding. DKIM signs the message, while DMARC aligns SPF or DKIM with the visible From domain and publishes a policy.
Why does MX Audit not show an exact recursive lookup count?
The quick browser check displays the published SPF policy but deliberately does not resolve every nested include. A precise count needs a full current DNS evaluation including error paths.