SPF Record Checker

Ten DNS lookups, hard limit

SPF evaluation must complete within 10 DNS lookups. Every include, a, mx, ptr and exists mechanism costs one, and includes nest — a single provider include can consume four on its own. Exceed the limit and the result is permerror, which most receivers treat as a failure. Adding one more vendor to a working record is the usual way a domain's mail suddenly starts failing.

The last mechanism decides everything

-all is hard fail, ~all is soft fail, ?all is neutral and +all permits the entire internet to send as you. Records ending ?all or +all provide no protection at all and appear surprisingly often. Start at ~all while auditing, then tighten to -all.

One record per domain

Two SPF records on the same name is a permanent error, not a merge. Adding a second when a new provider is onboarded is a frequent mistake; the mechanisms must go into the existing record instead.

SPF alone does not stop spoofing

It authenticates the envelope sender, not the From header a recipient sees. Alignment between them is what DMARC checks, which is why SPF without DMARC leaves display-name spoofing wide open. It also breaks on forwarding, since the forwarder's IP is not in your record — the reason DKIM matters alongside it.

Related tools

• Password Strength Checker — Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
• Password Generator — Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
• Hash Generator — Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.
• Base64 Encoder/Decoder — Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.