What happens when SPF needs more than 10 DNS lookups?

Receivers stop evaluating and return a permanent error (permerror), which DMARC treats as an SPF failure. Removing unused includes or flattening them fixes it.

Should my SPF record end in ~all or -all?

Use -all once every legitimate sender is listed. ~all (softfail) is a transition setting; with DMARC enforcement the difference matters less, but -all is clearer.

Can a domain have two SPF records?

No. Two v=spf1 records make SPF fail with permerror. Merge them into one record.

SPF checker

Check SPF for any domain and get a corrected record in seconds.

SPF (Sender Policy Framework) is a TXT record that lists the servers allowed to send mail for your domain. Receivers evaluate it on every message, and a broken SPF record is one of the most common reasons legitimate email lands in spam.

MailVakt resolves every include, a, mx, exists and redirect, counts DNS lookups against the limit of 10 and void lookups against the limit of 2, flags multiple records and permissive qualifiers, and proposes a merged record for the senders it detects.

Questions

What happens when SPF needs more than 10 DNS lookups?: Receivers stop evaluating and return a permanent error (permerror), which DMARC treats as an SPF failure. Removing unused includes or flattening them fixes it.
Should my SPF record end in ~all or -all?: Use -all once every legitimate sender is listed. ~all (softfail) is a transition setting; with DMARC enforcement the difference matters less, but -all is clearer.
Can a domain have two SPF records?: No. Two v=spf1 records make SPF fail with permerror. Merge them into one record.

Fix this from ChatGPT or Claude

MailVakt is an MCP server, so your assistant can run this check itself, read the findings and walk you through the DNS edit. Ask it:

“Check the SPF record for example.com: count the DNS lookups, flag any problems, and give me a corrected record.”

Claude: Settings → Connectors → Add custom connector, then paste https://mcp.mailvakt.com/mcp.
Cursor and other MCP clients: add the same address as an MCP server. Setup details.

Checks are free and need no account. Sign in only to collect DMARC reports for a domain.