Resolve and analyze the SPF record for any domain - including recursive include chains, DNS lookup counting, and policy violation detection.
Enter a domain to analyze its SPF record
SPF (Sender Policy Framework) is a DNS TXT record that lists which servers are authorized to send email on behalf of a domain. Receiving mail servers check this record against the sender's IP - if the IP isn't listed, the email can be rejected or flagged as spam.
The most critical part of the SPF record is the catch-all mechanism at the end: -all (hard fail, reject unlisted senders), ~all (soft fail, mark but accept), ?all (neutral, no effect), or +all (pass all senders - effectively disables SPF). For strong spam protection, always end with -all.
RFC 7208 limits SPF evaluation to 10 DNS lookups. The include:, a, mx, ptr, exists, and redirect= mechanisms each count as one lookup. Going over the limit causes a PermError, which means receiving servers will treat the email as if SPF failed - even though the sending IP might be legitimately authorized.
SPF alone is not enough. For full email authentication, combine SPF with DKIM signing and a DMARC policy. Without DMARC, a passing SPF check can still be bypassed using the display name while sending from a different domain.
Sent to our server: Domain and Sender IP (if you give one). We look it up in DNS. Part of this work runs on our own server. To answer a repeated check fast, we have to keep answers for 5 minutes; then they are deleted. Also added to the page link, so you can share the result: Domain and Sender IP (if you give one).