Nekonote Toolbox logo

Nekonote Toolbox

Free browser-based tools for developers and IT admins.

日本語

SPF Record Checker

Privacy: a record you paste stays in your browser. To look up a domain, or to follow include and redirect, the domain names involved are sent to Cloudflare's public DNS-over-HTTPS service (cloudflare-dns.com). They are not sent to this site.

About this tool

SPF (Sender Policy Framework) is a DNS record that lists which servers may send email for your domain. A broken or oversized SPF record makes mail go to spam or get rejected. This checker reads a record, checks its syntax against RFC 7208, follows every include and redirect to count the DNS lookups, and explains each term.

You can enter a domain name to fetch its record, or paste a record you are about to publish.

How it works

  • Syntax: the record must start with v=spf1. Terms are mechanisms (all, include, a, mx, ptr, ip4, ip6, exists) with an optional qualifier (+ pass, - fail, ~ softfail, ? neutral), or modifiers (redirect=, exp=). IPv4 and IPv6 addresses and prefix lengths are validated, and so is the shape of every domain name. Unknown modifiers are allowed by the standard and are reported as ignored.
  • Lookup limit: a receiver may make at most 10 DNS lookups while evaluating a record, and more than that is a permanent error (permerror), so the policy is ignored. The terms that count are include, a, mx, ptr, exists and redirect, in the record and in every record they lead to. ip4, ip6, all and exp do not count. The same include used twice counts twice.
  • The count is the worst case, as if every term had to be evaluated. A real receiver stops at the first term that matches the sending IP, so it may use fewer lookups. Terms after all, and redirect when all is present, are never evaluated, so they are not counted.
  • The checker makes at most 60 DNS queries and counts at most 200 lookups in one run, and it reports it if it stops early. It stops following a branch that loops back to a domain already on its path.
  • Not checked: macro expansion (a term with a macro such as %{i} is counted but not followed), the actual IP addresses behind a, mx and exists, the limit of 2 empty (void) lookups, and the limit of 10 MX hosts. Test final changes with a real message too.

FAQ

Q. Why does my record fail with too many lookups?

A. Services you include often include others. Remove services you no longer use, replace a and mx with ip4 and ip6 ranges where they are stable, or send different mail streams from different subdomains, each with its own record. Avoid "flattening" a provider's record by hand unless you will keep it up to date.

Q. Can a domain have two SPF records?

A. No. Two records starting with v=spf1 at the same name cause a permanent error. Merge them into one.

Q. Should I use -all or ~all?

A. -all tells receivers to reject mail from other servers and ~all asks them to treat it as suspicious. Many domains start with ~all while they confirm that every legitimate sender is listed, then move to -all. +all allows anyone to send as your domain and should never be used.

Q. Does SPF alone stop spoofing?

A. No. SPF checks the hidden envelope sender, not the From address people see. Use it together with DKIM and DMARC.