What is an SPF record? (plain English)
Think of SPF as a guest list on your domain’s front door for email. Only listed servers get to send mail that looks like it came from you.
What CrowWake checks
We look up the TXT record on your domain for a line that starts with v=spf1. We expand nested include: and redirect= terms, count RFC 7208 DNS lookups (include, a, mx, ptr, exists, redirect — limit 10), and warn if there are multiple SPF records, if the policy ends with +all (anyone can send), or if there is no clear ~all / -all ending. The free SPF checker shows the include tree with no login. For the repeat “watch this hourly” job, see the dedicated SPF monitoring guide.
Why it matters
Receivers (Gmail, Microsoft, and others) use SPF to decide whether a message claiming to be from you was sent from an allowed host. Bad or missing SPF is a common reason mail lands in spam—or gets rejected—especially after you add a new ESP, CRM, or marketing tool.
The 10 DNS-lookup limit
Each include, a, mx, ptr, exists, and redirect in the record — and inside nested includes — counts toward 10 lookups. Go over and receivers return permerror (SPF fails closed, even if the IPs look right). That is why “just add another ESP include” breaks mail. Flatten or drop unused includes before you add the next tool. The free SPF checker counts the tree so you see the number before you publish.
What “good enough” looks like
One SPF TXT record. It includes your real senders (Google Workspace, Microsoft 365, Mailchimp, transactional providers, and so on). It ends with ~all or -all—not +all. Keep the DNS lookup count under SPF’s limit (too many includes can silently fail).
If CrowWake crows
Missing SPF → publish one. Multiple SPF → merge into a single record. +all → tighten the ending. Over 10 DNS lookups → remove unused includes or flatten; do not add another ESP until the count is under 10. After DNS changes, give caches a few minutes, then re-run the free SPF checker.
Watch this on CrowWake
Add the domain, leave the boxes checked, and the flock will crow when this drifts.
Or try the free SPF checker with no login.
Deep dive: SPF monitoring — watch v=spf1 so a silent wipe, +all, or over-10-lookup tree crows early, with the same free SPF checker.
Stack overview: email authentication monitoring, what is email authentication. Also: DKIM monitoring, DMARC monitoring.