SPF lookup
Test a domain's SPF record, count the DNS lookups, and see the full include chain.
About this tool
SPF is a TXT record that lists which servers are allowed to send email from the domain. The receiving server compares the sending server's IP address against the list to decide whether the email is legitimate.
The tool fetches the record, breaks it down into mechanisms, and follows every include and redirect. You can see the full tree and how many DNS lookups the record requires. The standard allows a maximum of 10. Any more and SPF is treated as invalid, which can cause email to be rejected or sent to spam.
The end of the record determines what happens to email from servers not on the list: -all rejects it, ~all marks it as suspicious, ?all makes no judgement, and +all lets everything through.
Frequently asked questions
Can I have two SPF records?
No. If two exist, SPF is treated as invalid. Merge them into a single record that starts with v=spf1 and ends with a single all.
Should I use -all or ~all?
Both work well when you also have DMARC. -all is the strictest option. ~all is safer if you are not entirely sure that every service sending on your behalf is listed.
What do I do if the record has more than 10 lookups?
Remove services you no longer use. Replace includes with ip4 and ip6 entries where a service has fixed addresses. In some cases a service can send from a subdomain instead.
What SPF record should I use with email hosted at Admax?
The value is listed in the guide What is SPF in the knowledge base. You can also build the record using the SPF generator.