Home / Email Tools / SPF Check
Email Tools
Parse SPF, count lookups and flag syntax problems.
SPF Check parses the Sender Policy Framework record for a domain, validates the syntax, counts the DNS lookups used, and flags mechanisms that could break deliverability.
Enter a domain name (example.org) and run the tool. The probe fetches the SPF TXT record and parses every mechanism.
Input: Domain — e.g. example.org.
The output shows the raw SPF record, each mechanism (include, a, mx, ip4, ip6, exists, redirect), the total DNS lookup count, and the final qualifier (-all, ~all, ?all, +all). Exceeding 10 DNS lookups causes SPF to fail with "PermError". A "+all" or "?all" ending is effectively no policy and offers no protection.
→ Validate an SPF record before enabling it for a sending domain.
→ Count DNS lookups to stay under the RFC 7208 10-lookup limit.
→ Find mechanisms causing SPF PermError and delivery failures.
→ Audit a domain’s SPF policy strength (-all vs ~all vs +all).
RFC 7208 limits SPF evaluation to 10 DNS lookups (include, a, mx, exists, redirect) to prevent DoS. Exceeding it makes SPF return PermError, which most receivers treat as a fail — harming deliverability even when your policy is otherwise correct.
-all (hard fail) gives the strongest protection by telling receivers to reject unauthorised senders. ~all (soft fail) is safer while you are unsure of all your sending sources but offers weaker enforcement. Never use +all, which authorises every sender.
Flatten nested includes by replacing them with ip4/ip6 mechanisms where possible, use SPF macros cautiously, or move to a dedicated SPF flattening service. Monitor the lookup count whenever you add a new sending source.