SPF record check
Parses your SPF record, counts DNS lookups (10 max), and warns before you hit the RFC 7208 limit that silently breaks deliverability.
Quick answer
Lemwatch fetches your SPF record, expands every include/redirect, and alerts if you exceed 10 DNS lookups or ship a "+all" pass-anything policy.
What it checks
- Presence of a v=spf1 record on the apex
- DNS lookup count including nested includes
- All-mechanism qualifier (~all, -all, +all, ?all)
- Duplicate SPF records (invalid per RFC)
Where to find it in Lemwatch
Site details → Security → Email auth.
How to fix
- Consolidate includes; each vendor include counts as 1+ lookups.
- Remove old vendors you no longer use.
- Switch "+all" to "~all" or "-all".
- Delete any duplicate v=spf1 record — only one is allowed.
- Re-run the check.
FAQ
What happens at 11+ lookups?
Receiving servers may return "permerror" and your mail lands in spam or bounces.
Do subdomains inherit SPF?
No — publish SPF per sending subdomain.
Related