--- title: "SPF checker" description: "Check your SPF record for free: the 10-lookup limit, syntax errors, +all and duplicate records, plus DMARC and DKIM. Plain-English fixes, no sign-up." canonical: https://www.acquisity.ai/tools/spf-checker --- # SPF checker > Check your SPF record for free: the 10-lookup limit, syntax errors, +all and duplicate records, plus DMARC and DKIM. Plain-English fixes, no sign-up. Type your domain to see whether email servers will trust the email you send. We check SPF, DMARC and DKIM, and tell you how to fix anything that’s wrong. Use the tool in a browser at [/tools/spf-checker](https://www.acquisity.ai/tools/spf-checker). It is free and needs no sign-up. ## What an SPF record is An SPF record is a short line of text in your domain’s DNS that lists the services allowed to send email as you, such as Google Workspace, Microsoft 365 or your newsletter tool. When your email arrives, Gmail or Outlook looks up that list. If the server that sent it isn’t on the list, the email is more likely to land in spam or be rejected. It lives in a [TXT record](https://www.acquisity.ai/tools/txt-record-lookup) on your domain and always starts with v=spf1. Each part after that names something allowed to send, and the last part (usually ~all or -all) says what to do with everything else. ## What this checker looks at - That you have exactly one SPF record, and that email servers can read it. - Every part of the record, so a typo doesn’t quietly break it. - The DNS lookups it needs, counted through every service it includes. Email servers stop at 10. - Entries that point at nothing (more than two break SPF). - The ending rule: +all lets anyone send as you; ~all and -all protect you. - Whether your inbox provider is in the list. - Your DMARC record: whether you have one, what it does, and whether reports reach you. If you have none, the [DMARC generator](https://www.acquisity.ai/tools/dmarc-generator) builds one. - DKIM under the names Google, Microsoft and other common services use. ## How to fix the most common SPF problems Two or more SPF records: combine them. Keep one line that starts with v=spf1, put every include and ip4 from all of them in it, end it with ~all, and delete the others. Too many DNS lookups: remove services you no longer use. Each include of a big provider can cost several lookups, so the count adds up fast. Replace a and mx entries with the ip4 addresses of the servers that send, where you can. Ends in +all: change it to ~all. +all tells every server in the world that it may send as you. No SPF record: add a TXT record at your domain’s root (shown as @ by most DNS providers). The [SPF record generator](https://www.acquisity.ai/tools/spf-record-generator) builds the value for you. ## Questions ### What does an SPF checker do? It looks up your domain’s SPF record the same way Gmail or Outlook does, then checks it against the rules they apply: one record, valid syntax, no more than 10 DNS lookups and a sensible ending rule. This one also checks DMARC and DKIM, because email servers judge all three together. ### What is the SPF 10 lookup limit? Email servers look up at most 10 names while reading your SPF record. Each include, a, mx, ptr, exists and redirect costs one, and the services you include can include others. Past 10, the server treats your SPF as an error, which is the same as having no SPF at all. ### Should my SPF record end in ~all or -all? Both protect you. ~all (soft fail) marks email from unlisted servers as suspicious and is the usual safe choice. -all (hard fail) asks servers to reject it, which is stricter but bounces email from any service you forgot to list. Never use +all. ### Can I have two SPF records? No. A domain must have exactly one. With two, email servers treat SPF as broken. If two services each told you to add one, merge them into a single record. ### Why can’t you find my DKIM? DKIM keys are stored under a name (a selector) that each email service picks, and DNS has no way to list them. We try the names Google Workspace, Microsoft 365 and other common services use. If yours uses another name, open an email you sent, view the original message and look for s= in the DKIM-Signature line, then enter that name. ### How long until a change shows up? Usually a few minutes, but DNS changes can take up to 48 hours to reach everyone, depending on your DNS provider and the record’s TTL. Run the check again after you save. ## Sending cold email? Keep it off your main domain. Acquisity sends cold email from separate domains, with SPF, DKIM and DMARC set up for you. [Cold Email Agent](https://www.acquisity.ai/agents/cold-email). --- Web page: https://www.acquisity.ai/tools/spf-checker Site index for agents: https://www.acquisity.ai/llms.txt