SPF record checker
Validate a domain’s SPF record: each term and qualifier, every include followed as a tree, DNS lookups counted against the limit of 10 and empty ones against 2.
v=spf1- Version
include:_spf.mail.example- 3 lookups, 2 inside it
include:send.example.net- 1 lookup
mx- 1 lookup
a- 1 lookup
ip4:203.0.113.0/24- No lookup
~all- The rest is suspect
6of 10 lookups
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
Each include, a, mx, exists and redirect costs a lookup, and so does every one inside an include. ip4, ip6 and all cost none. Past ten, SPF fails for every message.
What does it check?
No rule in the rulebook covers this, so here is what it reads.
- The SPF record, and whether there is exactly one
- Every include, followed
- How many DNS lookups it takes, against the limit of ten
- Whether it ends in ~all or -all
Questions
What is the SPF lookup limit?
Ten. Each include, a, mx, exists and redirect counts, and past ten the check fails.
Should it end in ~all or -all?
Either works once DMARC is set. -all tells receivers to refuse what the list does not name. ~all marks it as suspect.
Can a domain have two SPF records?
No. Two records make SPF fail. Merge them into one.
The whole site
One page is one part. A read checks every page against the whole rulebook and says what to fix first.
Read a whole site