SPF Checker

Start with the sender domain

Enter the domain whose published SPF configuration you want to inspect. The checker selects v=spf1 candidates from TXT records, preserving resource-record boundaries. More than one candidate is a configuration problem.

The first version performs static configuration analysis. It does not accept a sender IP, MAIL FROM or HELO identity and cannot decide whether a particular sending host is authorized.

example.com. 300 IN TXT "v=spf1 include:mail.example -all"

DOCUMENTATION EXAMPLE — not a live DNS response

Follow include and redirect evidence

The checker follows literal include and redirect domains, detects clear cycles and preserves the DNS queries made along the way. redirect is not applied when an all mechanism is present.

Operations have a product request budget, depth limit and time limit. Reaching a safety limit is reported as incomplete, not as a successful analysis or proof that a domain has exceeded a protocol limit.

Lookup terms are not browser requests

RFC 7208 limits DNS-causing terms on an evaluated SPF path. The number of HTTP requests made by this browser and the number of terms found across a static dependency graph are different measurements.

A graph can contain branches that a real sender never reaches. A static total above ten is a risk observation, not a claim that every message must return PermError. Runtime void-lookup behavior and address matching require sender context.

Interpreting all and unsupported paths

-all expresses fail intent for unmatched senders; ~all expresses softfail intent and is not automatically an error. +all permits all senders and should be understood carefully. None guarantees delivery or inbox placement.

IP literal CIDRs and common mechanism/modifier syntax are checked. Complex macro-dependent paths are marked incomplete rather than expanded with fictional sender details. ptr is discouraged; this tool does not simulate its sender-IP evaluation.

The checker never automatically flattens SPF or produces a record that you should publish without review. Keep the original configuration and verify changes using your actual sending services.