Security & SEO

SPF record check

Parses your SPF record, counts DNS lookups (10 max), and warns before you hit the RFC 7208 limit that silently breaks deliverability.

Updated 2026-07-10

1 min read

spf

deliverability

Quick answer#

Lemwatch fetches your SPF record, expands every include/redirect, and alerts if you exceed 10 DNS lookups or ship a "+all" pass-anything policy.

What it checks#

Presence of a v=spf1 record on the apex

DNS lookup count including nested includes

All-mechanism qualifier (~all, -all, +all, ?all)

Duplicate SPF records (invalid per RFC)

Where to find it in Lemwatch#

Site details → Security → Email auth.

How to fix#

Consolidate includes; each vendor include counts as 1+ lookups.

Remove old vendors you no longer use.

Switch "+all" to "~all" or "-all".

Delete any duplicate v=spf1 record — only one is allowed.

Re-run the check.

FAQ#

What happens at 11+ lookups?#

Receiving servers may return "permerror" and your mail lands in spam or bounces.

Do subdomains inherit SPF?#

No — publish SPF per sending subdomain.

DKIM record check

DMARC record check

DNS MX record check

Was this article helpful?

How to use the free Core Web Vitals checker

DKIM record check

Verifies DKIM selector records exist and use ≥1024-bit keys — the invisible half of email deliverability that most teams forget.

DMARC record check

Explains how to read a DMARC record, assess SPF and DKIM alignment, and make a staged policy decision without treating a DNS record as proof of mail delivery.

DNS MX record check

Monitors MX records so a fat-fingered mail edit or expired provider does not silently break customer email.

Certificate Transparency Monitoring

Monitor SSL certificate issuance and detect unauthorized certificates.

Back to Help Center