SPF Checker

About SPF checker

SPF Checker fetches the SPF record published by a domain, breaks it into individual terms and counts how many DNS lookups it costs against the limit of 10 defined in RFC 7208. Exceeding that limit is the classic hidden SPF failure, because receivers then ignore the record entirely.

How to use it

1. Enter the sending domain, such as example.com, in the Domain box.
2. Press Check SPF. Our server reads the TXT record starting with v=spf1 and expands each include and redirect it finds.
3. Read the banner and the DNS lookup budget bar, which shows lookups used out of 10.
4. Study the Mechanisms table to see which terms cost a lookup and which are free, then the Expanded lookup chain for nested includes.
5. Work through the Diagnostics list, which separates errors from warnings.

Counting the lookup cost

v=spf1 ip4:203.0.113.0/24 include:_spf.google.com include:mailgun.org mx ~all

Direct lookups: 3 (the two includes and mx). ip4 and all are free. The qualifier on all is ~ (softfail). Expanding each include adds more lookups on top of the 3.

When to use it

• Diagnosing why authentication fails after you added another email vendor.
• Verifying that a domain has exactly one SPF record before rolling out DMARC enforcement.
• Deciding when to flatten includes because the record has hit 9 or 10 lookups.
• Spotting a leftover plus-all that authorizes every server on the internet.

Questions about SPF checker

Which terms count toward the limit of 10?

include, a, mx, ptr, exists and the redirect modifier each cost one lookup, including those inside nested records. The ip4, ip6 and all mechanisms are free. Going past 10 gives permerror.

Why does having two SPF records break everything?

A domain must publish exactly one v=spf1 record. Two records produce a permerror at the receiver, and they are not merged. The tool lists every record it finds so you can combine them into one.

What is the difference between minus-all and tilde-all?

Minus-all tells receivers to reject mail from servers you did not list, while tilde-all is a softfail that usually sends it to spam. A question-mark all asserts nothing, and plus-all permits everyone, so the tool warns about both.

Why are some includes not expanded?

Terms containing macros cannot be resolved without a real sending address, and a loop or repeated include is only followed once. The chain table notes each case. Expansion also stops after 30 queries.

Where does the check run?

On our server, which receives the domain and runs the DNS queries. Up to 12 checks per minute are allowed per visitor.

Related tools

• DMARC checkerParse a domain's DMARC policy, validate every tag, and explain in plain English what the policy actually does.
• IP LookupLook up information about an IP address
• DNS LookupLook up DNS records for a domain
• WHOIS LookupLook up WHOIS information for a domain
• PingPing a domain or IP address
• SSL LookupLook up SSL certificate information for a domain