warnwell

Warnwell / Checks

SPF record checker with the 10-lookup count

Paste one domain or a list. Warnwell shows each SPF record, follows every include: to count the DNS lookups, and flags the setups that make your own mail fail.

  • Free
  • No sign-up
  • Up to 50 domains at once

01

What it checks

  • The record itself. The TXT record on the domain that starts with v=spf1, shown in full under "SPF record".
  • Lookups. Each include:, a, mx, exists: and redirect= costs one DNS lookup, and so does every one inside the records they pull in. RFC 7208 caps the total at 10. Over that, receivers return a permanent error and treat your SPF as failed. Warnwell follows the chain and prints the count, for example "(7 lookups of 10)".
  • Two SPF records. A domain may have only one. With two, receivers ignore both. This often happens when a second email tool asks you to "add this TXT record" and nobody merges it into the first.
  • +all or a bare all. These approve mail from every server on the internet, which is the same as having no SPF.
  • Mail without SPF. A domain with MX records and no SPF gets "No SPF record", since its own mail is more likely to land in spam.

SPF on its own does not stop someone faking your address in the From line that people see. That needs DMARC, which the same report checks. For a domain that sends no mail at all, the right SPF record is v=spf1 -all.

02

Reading the result

Green means one record, under 10 lookups, ending in -all or ~all. "SPF needs 13 DNS lookups (limit 10)" in red means some of your real mail already fails SPF at strict receivers. How to get under 10 lookups.

03

Questions

What is the difference between ~all and -all?
~all (softfail) asks receivers to accept but mark mail from unlisted servers. -all (fail) asks them to reject it. With DMARC at p=reject the difference matters little, because DMARC decides. For a domain that sends no mail, use -all.
Do ip4: and ip6: count toward the 10 lookups?
No. They need no DNS query, which is why swapping an include: for the provider's IP ranges is one way under the limit. The catch: if the provider changes its addresses, your record goes stale.
Why does the lookup count differ from another tool?
Tools differ on void lookups and on how deep they follow the chain. Warnwell counts include:, a, mx, ptr, exists: and redirect=, and opens up to 9 included records, 4 levels deep. On a very long chain its count can come out low, never high.
Can I check SPF for many domains at once?
Yes, up to 50 per run. Paste them one per line. The CSV export has the SPF record of each domain in its own column.
04

Updated 20 Oct 2026.