SPF Checker

What gets checked

The tool walks an SPF record the same way a receiving mail server does under RFC 7208: it follows every include and redirect, counting DNS lookups across all nested records along with void queries. The limits are 10 lookups and 2 void queries, and once a sender passes them, receivers stop the check with an error.

Errors are searched for in every nested record, not just the first one: an address without ip4:, an include pointing to a name that does not exist, a typo like include= instead of include:, or two SPF records on the same domain. For each one, the tool says what it threatens your mail with.

Addresses and mail services

From the whole tree the tool assembles a list of allowed networks with the number of addresses in each and where each one came from. Duplicates and networks contained inside wider ones are marked. The names in include entries reveal the mail services, mailing-list providers, and hosting companies behind them.

Building a record

To put together a new record from your mail services, your own addresses, and your domain's servers, use the SPF generator. A domain can have only one SPF record, so the new one replaces the old.