SPF Checker
1. Enter Domain
Load Sample
2. SPF Policy Details
Domain–
SPF Status–
SPF Record–
Lookup Count–
–
How to Use the SPF Record Checker
- Enter the domain you wish to analyze.
- Click the check button.
- Review the raw SPF record, validation status, and syntax breakdown.
Formulas and Technical Logic
Sender Policy Framework (SPF) prevents email spoofing. The checker queries the domain’s TXT records looking for a string beginning with ‘v=spf1’. It then parses the mechanisms (e.g., include, a, mx, ip4) and qualifiers (+, -, ~, ?). The tool calculates the number of DNS lookups to ensure it does not exceed the strict RFC limit of 10 lookups.
Key Features
- Validates SPF syntax against RFC 7208.
- Counts and warns about the 10 DNS lookup limit.
- Highlights deprecated mechanisms (like ‘ptr’).
- Explains the policy qualifier (e.g., SoftFail vs HardFail).
Reference Table: SPF Qualifiers
| Qualifier | Name | Action |
|---|---|---|
| + | Pass | Accept the email (default if no qualifier). |
| – | Fail | Reject the email (HardFail). |
| ~ | SoftFail | Accept but mark as suspicious. |
| ? | Neutral | No policy stated; treat as neutral. |
Frequently Asked Questions
What is the 10 DNS lookup limit?
To prevent Denial of Service attacks, SPF evaluation is restricted to a maximum of 10 DNS lookups per record. Exceeding this causes a PermError.
What is the difference between ~all and -all?
The ~all qualifier is a SoftFail, typically meaning unauthorized emails may be delivered to spam. The -all qualifier is a HardFail, instructing receiving servers to reject unauthorized emails entirely.