TapCub is live — analytics, insights and live chat, free on one platform

Checker · SPF SPF checker: is your sender list valid and under 10 lookups?

SPF lists the servers allowed to send mail as your domain. It breaks quietly: a second SPF record, an include that no longer exists, or one marketing tool too many pushing you past 10 DNS lookups. This checker follows every include and counts the way receivers do.

  • 10 record types
  • Compare 3 resolvers
  • Sent only when you click
Lookup

Check an SPF record

Look up a domain’s SPF record, or paste one to check the syntax locally. Click Look up to follow the includes.

What is sent, and to whom. Nothing is requested when the page opens. When you click Look up or press Enter, your browser asks the DNS-over-HTTPS service you pick — Cloudflare (cloudflare-dns.com), Google (dns.google) or Alibaba Cloud (dns.alidns.com) — for the name and record type, nothing else. Checks that follow a chain (SPF includes, MX hosts) send those names to the same service. TapCub’s servers are not involved and store nothing.

Subdomains, underscore names such as _dmarc.example.com and international domains all work.

In mainland China, Alibaba Cloud is usually reachable when the other two are not.

Starts with v=spf1. Checked in your browser; includes are followed when you click Look up.

DNS lookups

10

Limit 10

Void lookups

0

Should stay at 2 or fewer

Summary

  • Warning10 of 10 allowed DNS lookups used.
  • Note“~all” (soft fail): mail from unlisted servers is marked suspicious but usually still delivered. Common while you confirm every sender is listed.
  • NoteTerms with macros (the % syntax): 1. They are counted, but cannot be followed without a real message.
  • NoteSample result: these records were looked up on 2026-11-11 while building this page. Click Look up for live data.

Terms

TermIf it matchesWhat it doesLookups
ip4:192.30.252.0/22PassSenders in 192.30.252.0/220
include:spf.protection.outlook.comPassChecks the SPF record of spf.protection.outlook.com1
include:_netblocks.google.comPassChecks the SPF record of _netblocks.google.com1
include:_netblocks2.google.comPassChecks the SPF record of _netblocks2.google.com1
include:mail.zendesk.comPassChecks the SPF record of mail.zendesk.com1
include:_spf.salesforce.comPassChecks the SPF record of _spf.salesforce.com1
include:servers.mcsv.netPassChecks the SPF record of servers.mcsv.net1
include:mktomail.comPassChecks the SPF record of mktomail.com1
include:sendgrid.netPassChecks the SPF record of sendgrid.net1
ip4:62.253.227.114PassSenders in 62.253.227.1140
ip4:166.78.69.169PassSenders in 166.78.69.1690
ip4:166.78.69.170PassSenders in 166.78.69.1700
ip4:166.78.71.131PassSenders in 166.78.71.1310
~allSoft failMatches every sender (the default at the end)0

Include tree

LevelIncludeRecordLookupsStatus
1include:spf.protection.outlook.comv=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all0OK
1include:_netblocks.google.comv=spf1 ip4:74.125.0.0/16 ip4:209.85.128.0/17 ~all0OK
1include:_netblocks2.google.comv=spf1 ip6:2001:4860:4000::/36 ip6:2404:6800:4000::/36 ip6:2607:f8b0:4000::/36 ip6:2800:3f0:4000::/36 ip6:2a00:1450:4000::/36 ip6:2c0f:fb50:4000::/36 ~all0OK
1include:mail.zendesk.comv=spf1 ip4:103.151.192.0/23 ip4:185.12.80.0/22 ip4:188.172.128.0/20 ip4:192.161.144.0/20 ip4:216.198.0.0/18 ~all0OK
1include:_spf.salesforce.comv=spf1 exists:%{i}._spf.mta.salesforce.com -all1OK
1include:servers.mcsv.netv=spf1 ip4:205.201.128.0/20 ip4:198.2.128.0/18 ip4:148.105.0.0/16 -all0OK
1include:mktomail.comv=spf1 ip4:199.15.212.0/22 ip4:72.3.185.0/24 ip4:72.32.154.0/24 ip4:72.32.217.0/24 ip4:72.32.243.0/24 ip4:94.236.119.0/26 ip4:37.188.97.188/32 ip4:185.28.196.0/22 ip4:192.28.128.0/18 ip4:103.237.104.0/22 ip4:130.248.172.0/24 ip4:130.248.173.0/24 ~all0OK
1include:sendgrid.netv=spf1 ip4:167.89.0.0/17 ip4:208.117.48.0/20 ip4:50.31.32.0/19 ip4:198.37.144.0/20 ip4:198.21.0.0/21 ip4:192.254.112.0/20 ip4:168.245.0.0/17 ip4:149.72.0.0/16 ip4:159.183.0.0/16 ip4:134.128.64.0/18 ip4:159.26.176.0/20 include:ab.sendgrid.net ~all1OK
2include:ab.sendgrid.netv=spf1 ip4:223.165.113.0/24 ip4:223.165.115.0/24 ip4:223.165.118.0/23 ip4:223.165.120.0/23 ~all0OK
The record
v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all
Parsing, checks and the zone-file text are produced in your browser. The only network traffic is the DNS-over-HTTPS queries listed above, sent directly from your browser when you click; TapCub never sees which domain you looked up.

Share these inputs: the values go after the # in the link, so they never reach a server.

Version v1.0Updated Update history

Read the result

Reading an SPF result

Three numbers and one word decide whether SPF works.

DNS lookups (limit 10)

include, a, mx, ptr, exists and redirect each cost one lookup, and lookups inside includes count too. Over 10, receivers return a permanent error and SPF fails for everyone.

Void lookups (2 or fewer)

Lookups that find nothing. RFC 7208 suggests receivers give up after two, so clean out includes for services you no longer use.

The “all” at the end

-all fails unlisted servers, ~all soft-fails them, ?all is neutral and +all lets anyone pass. Only -all and ~all protect the domain.

One record only

A domain may publish exactly one v=spf1 TXT record. Two records are a permanent error, which is the most common SPF bug after adding a new email service.

SPF checks the envelope sender (Return-Path), not the From address people see. DMARC ties the two together; check it next.

How to use it

Three steps

No sign-up. One click sends the queries.

  1. 1

    Enter a name

    A domain, subdomain, URL or email address. Paste an IP address for a reverse lookup.

  2. 2

    Pick type and resolver

    Common types is the usual start. Choose “Compare all three” after a DNS change to see whether it has spread.

  3. 3

    Look up and copy

    Read the summary, then copy the zone-file lines or download them. Open the MX, SPF, DMARC or DKIM checker for mail records.

How it works

SPF rules (RFC 7208)

The checks this tool runs, with the section they come from.

  • Exactly one record starting with v=spf1 (§4.5)
  • At most 10 terms that cause DNS lookups, counted through includes and redirect (§4.6.4)
  • Void lookups should be limited to 2; each mx may resolve at most 10 hosts (§4.6.4)
  • include must point to a domain with its own SPF record, or the result is a permanent error (§5.2)
  • ptr SHOULD NOT be published (§5.5); terms after all are never evaluated (§5.1); redirect is ignored if all is present (§6.1)
How TapCub separates sources
What each SPF term costs
TermDNS lookupsExample
ip4 / ip60ip4:192.0.2.0/24
all0~all
include1 + whatever the included record usesinclude:_spf.google.com
a / mx1 (mx: plus up to 10 address lookups)mx
exists / ptr1exists:%{i}._spf.example.com
redirect=1 + the target recordredirect=_spf.example.com
Example

github.com: exactly at the limit

Looked up on 2026-11-11: eight includes for the services GitHub sends through, and two more lookups inside them.

github.com SPF, followed through every include (2026-11-11)
PartLookupsWhy
8 × include at the top (Microsoft 365, Google, Zendesk, Salesforce, Mailchimp, Marketo, SendGrid)8One per include
_spf.salesforce.com → exists:%{i}…+1exists costs a lookup
sendgrid.net → include:ab.sendgrid.net+1A nested include
ip4 ranges and ~all0Free
Total10 of 10Valid, with no headroom for another service

Adding one more include would break SPF for every message. At this point teams usually move a service to a subdomain with its own SPF record, or replace includes with ip4 ranges the provider guarantees.

Common mistakes

SPF mistakes

Usually the record is fine and something else is in the way.

A second record for a new tool

Each service’s setup page shows “v=spf1 include:… ~all”. Add the include to your existing record instead of publishing another one.

Includes for tools you dropped

Old includes still cost lookups, and an include whose domain is gone is a permanent error. Remove them when you cancel a service.

Ending with +all

+all passes every server on the internet. It is sometimes added “to stop bounces” and makes forging your domain trivial.

In TapCub

Where domains show up in your analytics

DNS answers practical questions behind the reports: who sent this traffic, which network a crawler came from, and how the tracking script is served.

Referring domains

Sources lists the sites that send visitors. Look up an unfamiliar one to see whether it resolves and who hosts it before you trust its traffic.

Learn more

Bots counted separately

TapCub separates crawlers from people with five layers, one of them hosting networks. A PTR lookup shows the hostname a crawler’s IP publishes.

Learn more

No CNAME tricks

TapCub does not use CNAME aliasing to make its requests look first-party. The cookie policy lists what else it deliberately does not do.

Learn more
See TapCub analytics
FAQ

DNS lookup questions

Still have a question?

Chat with the team behind TapCub — we usually reply within a few hours on business days.

Chat with usHelp center
How do I fix “SPF too many DNS lookups”?

Remove includes for services you no longer use, replace includes with the ip4/ip6 ranges a provider documents as stable, or send marketing mail from a subdomain with its own SPF record. Flattening tools that copy IPs work too, but must be kept in sync when providers change addresses.

Should I use ~all or -all?

Both protect the domain once DMARC is in place, because DMARC decides what happens to failing mail. ~all is the safer start while you confirm every legitimate sender is listed; -all asks receivers to reject outright.

Can a domain have two SPF records?

No. RFC 7208 makes two v=spf1 records a permanent error, so SPF fails for all mail. Merge the mechanisms into one record.

Do Gmail and Yahoo require SPF?

Gmail’s sender guidelines ask every sender to set up SPF or DKIM, and senders of more than 5,000 messages a day to Gmail to set up both plus DMARC. Yahoo publishes the same split for bulk senders.

Does SPF check the From address?

No, it checks the envelope sender (Return-Path / MAIL FROM). That is why SPF alone does not stop spoofed From addresses; DMARC requires one of SPF or DKIM to pass for a domain that aligns with From.

Changelog

Update history

New features, fixes and data refreshes for this tool, newest first.

  1. · v1.0

    LaunchedFirst release.

Missing something or found an error? Tell us — requests that come up often go into the next update. All tool updates

Next step

From the domain to the visitors it brings

TapCub shows where visitors come from, separates bots from people, and adds live chat on the same snippet. No cookies in the default mode.

Start freeExplore analytics
WHOIS lookupRegistrar, dates and status of a domain. Email validatorCheck a list of addresses, with an MX check. Email header analyzerSee SPF, DKIM and DMARC results on a real message.

See your data clearly. Find your growth.

Every click, backed by data. Install one line of code and see your first numbers in a minute.

Start free See a live demo

No credit card · Free plans for analytics and chat · Cookieless analytics