Check a domain's email authentication

SPF, DKIM, DMARC, MX and BIMI in one request. Including the ten-lookup limit that silently breaks SPF and that most free checkers do not count.

Why the lookup count matters

RFC 7208 caps SPF evaluation at ten DNS lookups. The cap is recursive — every include: costs one lookup plus everything its own record chains to. Go over and receivers return permerror, which means SPF stops authenticating your mail completely.

Nothing in your DNS looks wrong when this happens. The record is still there, still valid to read, still returned by every "is my SPF record OK" tool that only checks syntax. This checker resolves the entire include chain and counts it properly.

Tools

SPF record generatorPick your senders from 59 verified providers and watch the lookup budget as you go. DMARC record generatorEvery tag explained, with warnings for the combinations that quietly do nothing. Email header analyserPaste raw headers for the SPF, DKIM and DMARC verdicts — and the alignment check that decides the outcome. DMARC report readerDrop a gzipped aggregate report straight in and see which sources are failing.

Common failures

SPF permerrorA permanent, unrecoverable problem in your SPF record. SPF is not failing "sometimes" — it is n… SPF: too many DNS lookupsRFC 7208 caps an SPF evaluation at 10 DNS lookups. Past that, receivers return permerror and st… Multiple SPF records foundRFC 7208 permits exactly one SPF record per name. Publishing two makes receivers return permerr… SPF temperrorA transient DNS failure during SPF evaluation. Usually the receiver retries and the message is … SPF softfail (~all)The sending server is not on your authorised list, but you are asking receivers to accept the m… SPF hardfail (-all)The sending server is not authorised and you are asking receivers to reject the mail outright.…

All 18 failure states →

Set up a specific provider

Verified SPF include values and live lookup costs for 69 sending platforms.

Google Workspaceinclude:_spf.google.com · 1 lookup Microsoft 365include:spf.protection.outlook.com · 1 lookup Amazon SESinclude:amazonses.com · 1 lookup Twilio SendGridinclude:sendgrid.net · 2 lookups Mailchimpinclude:servers.mcsv.net · 1 lookup Zoho Mailinclude:zohomail.com · 2 lookups

All 69 providers →

Worked examples

What 293 well-known domains actually publish — useful for seeing what a real record looks like, and what normal is. Public DNS, resolved 2026-08-04.

github.comSPF 10/10 lookups · p=quarantine stripe.comSPF 7/10 lookups · p=reject netflix.comSPF 7/10 lookups · p=reject paypal.comSPF 9/10 lookups · p=reject

All 293 domains →