Can I have two SPF records?

No. Multiple TXT records starting v=spf1 produce a permanent error and authentication fails. Merge them into one record with multiple mechanisms.

What is the ten-lookup limit?

RFC 7208 caps DNS-querying mechanisms — include, a, mx, ptr, exists — at ten per evaluation, counting nested includes. Exceeding it is a permerror that most receivers treat as failure.

Should I use -all or ~all?

-all once your sender inventory is complete and verified. ~all is a transitional setting; many receivers treat a soft fail as no result at all, which gives you little protection.

Why does SPF fail when my mail is forwarded?

The forwarding server becomes the sending host and is not in your record. DKIM survives forwarding because it signs the message itself, which is why DMARC accepts either.

TLS & Email🌐 YAS server-sideAPI availableadvanced

SPF Inspector

Parses an SPF record: mechanism checks, DNS lookup count, and the policy (~all vs -all).

Processed by YAS · not stored

Ready to runInstant execution

All tools →

SPF Inspector — parse & validate v=spf1

Fetches the TXT record, counts DNS lookups (RFC 7208 limit: 10) and flattens includes.

What does this tool do?

Parses an SPF record: mechanism checks, DNS lookup count, and the policy (~all vs -all).

Why would I use it?

You received a warning that your domain's SPF is invalid.
You want to count DNS lookups to stay under the 10-query limit.
You are auditing email authentication.

Real-life example

Input

example.com

Output

v=spf1 include:_spf.google.com ~all — PASS · 3 DNS lookups

Includes an explanation of each mechanism.

Input → Process → Output → Next

Input: Enter a domain.
Process: YAS fetches the TXT record and parses mechanisms, counting lookups.
Output: Parsed mechanisms, lookup count, policy verdict.
Next action: Fix too many lookups and align the policy with your sending.

Common mistakes

Exceeding 10 DNS lookups (SPF breaks).
Using multiple SPF records (invalid — only one is used).
A permissive +all policy that allows spoofing.

What the result means

The policy (-all/~all) tells receivers how strictly to treat failures.

Privacy & security

Your input is sent to YAS infrastructure because the tool requires server-side processing or public network queries. Input is not stored.

API

Endpoint

POST https://yas.sh/api/v1/tools/spf-inspector

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/spf-inspector" \
  -H "Content-Type: application/json" \
  -d '{"input":"example.com"}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/spf-inspector", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "input": "example.com"
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/spf-inspector", json={"input":"example.com"})
data = r.json()

Field	Type	Required	Description
input	string	Yes	Domain, e.g. example.com

Success response

{ "result": { "record": "v=spf1 ip4:1.2.3.4 include:_spf.example.com ~all", "lookupCount": 2, "lookupLimit": 10, "hasAll": true, "allValue": "~all", "permError": false, "flattenedIps": 6, "tree": [...] } }

Parse SPF (v=spf1): mechanisms, DNS-lookup count vs the 10 limit, ~all/-all, flattened IP count.

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How SPF Inspector works

SPF publishes a TXT record listing which hosts may send mail for a domain. A receiver checks the SMTP envelope sender's domain (the MAIL FROM, not the visible From: header), evaluates the mechanisms in order — a, mx, ip4, ip6, include, exists — and applies the first match. The qualifier on the terminating all mechanism decides the outcome for everything else: -all is a hard fail, ~all a soft fail, ?all neutral.

The binding constraint is the ten-DNS-lookup limit in RFC 7208. Each include, a, mx, ptr and exists costs lookups, and nested includes count recursively. Exceeding ten produces a permerror, which most receivers treat as a failure — so an SPF record that grew by one SaaS provider too many can break authentication for every message the domain sends.

When to use it: real-world scenarios

Diagnosing mail that lands in spam after adding a sender

A new marketing or ticketing platform pushes the record over ten lookups, and every message starts failing SPF regardless of provider.

Auditing which services can send as your domain

SPF records accumulate includes for tools nobody uses any more, each one an authorised sender you have forgotten about.

Preparing for a DMARC enforcement move

DMARC requires SPF or DKIM to pass and align. Verifying SPF alignment before setting p=reject prevents rejecting your own mail.

Locking down a domain that sends no mail

A parked domain should publish v=spf1 -all plus a null MX, which removes it as a spoofing vector.

Pro tips

Publish exactly one SPF record. Two TXT records beginning v=spf1 is a permerror, and it is a common consequence of two teams adding one each.
Count lookups before adding an include. Flattening to ip4 ranges is a last resort — it breaks when the provider changes addresses, so it needs monitoring.
Prefer -all over ~all once you are confident of the sender list. A soft fail is widely treated as no signal at all.
SPF validates the envelope sender, so it breaks on forwarding. That is precisely why DKIM and DMARC exist alongside it.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

SPF authenticates the envelope domain, not the From: header a user sees, so it does not prevent display-name or header spoofing on its own.
Forwarding breaks SPF because the forwarder becomes the sending host; SRS or DKIM is needed to survive it.
The ten-lookup limit is a hard protocol constraint, not an implementation choice.
A pass means the host was authorised, not that the message is legitimate — spammers publish valid SPF for their own domains.

Frequently asked questions

Can I have two SPF records?: No. Multiple TXT records starting v=spf1 produce a permanent error and authentication fails. Merge them into one record with multiple mechanisms.
What is the ten-lookup limit?: RFC 7208 caps DNS-querying mechanisms — include, a, mx, ptr, exists — at ten per evaluation, counting nested includes. Exceeding it is a permerror that most receivers treat as failure.
Should I use -all or ~all?: -all once your sender inventory is complete and verified. ~all is a transitional setting; many receivers treat a soft fail as no result at all, which gives you little protection.
Why does SPF fail when my mail is forwarded?: The forwarding server becomes the sending host and is not in your record. DKIM survives forwarding because it signs the message itself, which is why DMARC accepts either.