SPF checker

SPF is a TXT record that lists which servers may send mail for a domain. It starts with v=spf1 and then names mechanisms such as include, ip4, mx, and all. When a message arrives, the receiving server looks at the IP address that connected to it and walks those mechanisms until one matches, or until it reaches all.

The result above is that published record, read live from public DNS. It shows what the record says, what each term means, and whether a receiver is likely to hit a permanent error while evaluating it.

How to read the result

The record line is the TXT data after quoted chunks are joined. A TXT record can be split into strings of at most 255 bytes, and those strings are concatenated with nothing inserted between them. Other TXT records on the same name, such as site-verification tokens, are not SPF.

Each mechanism is shown with a plain-language reading. include: names another domain whose own SPF policy is also authorized, which means you trust every server they trust. ip4: and ip6: authorize an address or range directly and do not need another lookup. a and mx authorize whatever addresses the domain's own A, AAAA, or MX records currently point at. all is the decision for every sender you did not list.

The 10-lookup limit

The mechanisms include, a, mx, ptr, and exists, plus the redirect modifier, cause DNS lookups. Nested includes count too, and each mail host returned by mx adds another lookup for that host's address. Receivers must stop and return a permanent error, called permerror, once an evaluation passes 10 of these lookups. Mail that hits permerror is not authenticated by SPF, even when the sending server is legitimate. The count on this page is the total a receiver may have to spend if it walks the whole policy. That is the number operators use when they ask whether a record is over the limit. Exactly 10 is allowed. 11 is not.

A macro such as %{i} still counts, but the name depends on a specific message, so it is not queried. ptr is counted, flagged, and not looked up: it is deprecated, and reverse DNS is not required to explain the record. The checker also stops after a fixed number of extra queries. If that cap is hit, the count is a minimum and the result says so.

Qualifiers

A mechanism can start with a qualifier. + is the default and means pass. - means fail. ~ means softfail, which many inboxes still accept. ? means neutral, which neither helps nor hurts. The qualifier on all is the one that matters most, because it is the decision for every sender you did not name earlier in the record.

Common mistakes

• Two TXT records that both start with v=spf1 are a permanent error. Receivers are not allowed to pick one. Merge them into a single record.
• Leaving a vendor's include in place after you stop using that vendor wastes lookups and can push a healthy record over 10. Adding a new sender without removing an old one is the usual way SPF breaks.
• +all authorizes the entire internet. ?all publishes a record that does not discourage spoofing. ~all is common and weaker than -all.
• Mechanisms written after all are never evaluated. redirect is ignored when all is present, because all always matches.
• ptr should be removed. A record with neither all nor redirect never says what to do with the rest of the internet.

This page does not open a mail port or test one IP address. It only reads public DNS for the domain you typed and for names that domain's SPF record already publishes.