---
title: "SPF record check — Lemwatch Help"
description: "Parses your SPF record, counts DNS lookups (10 max), and warns before you hit the RFC 7208 limit that silently breaks deliverability."
canonical: "https://lemwatch.com/help/spf-record-check"
source: "https://lemwatch.com"
---

# SPF record check

> Parses your SPF record, counts DNS lookups (10 max), and warns before you hit the RFC 7208 limit that silently breaks deliverability.

## Quick answer

 Lemwatch fetches your SPF record, expands every include/redirect, and alerts if you exceed 10 DNS lookups or ship a "+all" pass-anything policy.

## What it checks

- Presence of a v=spf1 record on the apex

- DNS lookup count including nested includes

- All-mechanism qualifier (~all, -all, +all, ?all)

- Duplicate SPF records (invalid per RFC)

## Where to find it in Lemwatch

 **Site details → Security → Email auth.**

## How to fix

- Consolidate includes; each vendor include counts as 1+ lookups.

- Remove old vendors you no longer use.

- Switch "+all" to "~all" or "-all".

- Delete any duplicate v=spf1 record — only one is allowed.

- Re-run the check.

## FAQ

### What happens at 11+ lookups?

 Receiving servers may return "permerror" and your mail lands in spam or bounces.

### Do subdomains inherit SPF?

 No — publish SPF per sending subdomain.

## Related

- DKIM record check

- DMARC record check

- DNS MX record check


## Related

- [Help centre](https://lemwatch.com/help)
- [DKIM record check](https://lemwatch.com/help/dkim-record-check)
- [DMARC record check](https://lemwatch.com/help/dmarc-record-check)
- [DNS MX record check](https://lemwatch.com/help/dns-mx-record-check)
- [Lemwatch pricing](https://lemwatch.com/pricing)
- [How does Lemwatch track SSL certificate expiry?](https://lemwatch.com/help/ssl-expiry-tracking)
- [Slack Integration](https://lemwatch.com/help/slack-integration)