Check an SPF record

Reads the live SPF record for a domain, checks the enforcement policy, and counts the DNS-querying mechanisms against the limit that silently disables SPF entirely.

What this means

What is the 10-lookup limit?

SPF evaluation is capped at 10 DNS-querying mechanisms (include, a, mx, ptr, exists, redirect). Exceed it and receivers return permerror, which most treat as no SPF at all. Adding one more email tool is the usual way this breaks — and nothing warns you, because your own mail keeps arriving.

Is ~all good enough?

~all (softfail) asks receivers to accept unauthorised mail but mark it. -all (fail) asks them to reject it. ~all is the safe place to start; -all is where you want to end up once you are certain every legitimate sender is listed.

Why does +all matter?

+all authorises the entire internet to send as your domain. It is never correct.