📧 SPF Record Checker

🖧
The selected healthy worker peer will originate this network request.
📧 SPF Mode
🔍 Domain Lookup
📝 SPF Parser
💡 Examples
Click to test domain:
Click to use template:
📋 Recent Checks
{{ item.timestamp }}
{{ item.type }}
⏳ Looking up SPF...
Please wait while we lookup the SPF record...
🔍 DNS Lookup Results
Domain: {{ results.domain }}
SPF Record Found: {{ results.spf_record ?'✅ Yes' :'❌ No' }}
SPF Record:
{{ results.spf_record }}
⚠️ Multiple SPF Records Found:
{{ record }}
Only one SPF record should exist per domain
⚠️ {{ results.error }}
📊 SPF Analysis
Record Status: {{ parsed.valid ?'✅ Valid' :'❌ Invalid' }}
Errors:
{{ error }}
Warnings:
{{ warning }}

Mechanisms ({{ parsed.mechanisms.length }})

{{ mechanism.original }} {{ getQualifierIcon(mechanism.qualifier) }} {{ mechanism.qualifierDescription }}
{{ mechanism.type.toUpperCase() }}: {{ mechanism.description }}
Value: {{ mechanism.value }}

Modifiers ({{ parsed.modifiers.length }})

{{ modifier.original }}
{{ modifier.type.toUpperCase() }}: {{ modifier.description }}
Value: {{ modifier.value }}
ℹ️ SPF Information

SPF Records: Sender Policy Framework (SPF) is an email authentication method that specifies which mail servers are authorized to send email on behalf of a domain.

DNS TXT Record: SPF records are published as DNS TXT records that start with"v=spf1" followed by mechanisms and modifiers.

Email Security: SPF helps prevent email spoofing by allowing receiving mail servers to verify the authenticity of the sender.

⚠️

ℹ️ About SPF Record Checker

SPF (Sender Policy Framework) is an email authentication policy published as a DNS TXT record. It lists the hosts, IP ranges, and delegated services that are allowed to send mail using a domain in the SMTP envelope sender, also called the return-path or MAIL FROM identity. Use this checker to look up a live domain record or paste a custom v=spf1 policy for syntax, mechanism, DNS-limit, and anti-spoofing review.

SPF is defined by RFC 7208. It helps receiving mail systems decide whether a connecting SMTP client is authorized for the envelope domain, but visible From: protection normally requires DMARC alignment from RFC 7489.

Common SPF checks

Domain lookup

  • • Queries TXT records and extracts the active v=spf1 policy
  • • Detects missing, malformed, or multiple SPF records
  • • Reviews DNS-mechanism lookup pressure before receivers hit limits
  • • Helps verify provider changes for Google Workspace, Microsoft 365, Mailgun, SendGrid, Amazon SES, and similar services

Record parser

  • • Splits mechanisms such as include, ip4, mx, and all
  • • Explains qualifiers: pass, fail, softfail, and neutral
  • • Reviews modifiers such as redirect and exp
  • • Flags broad or weak policies such as +all and unfinished ?all

Example SPF records

Simple outbound host

v=spf1 ip4:203.0.113.10 -all

Authorizes one IPv4 sender and asks receivers to fail all other sources for the envelope domain.

Hosted mail provider

v=spf1 include:_spf.example-mail.net include:send.example.net ~all

Delegates authorization to two providers and uses softfail while the sender inventory is still being confirmed.

SPF Mechanisms

Authorization Mechanisms

ip4 / ip6 - Exact senders or CIDR ranges
include - Authorize a third-party SPF policy when that policy passes
a - Authorize the domain's A or AAAA addresses
mx - Authorize hosts listed in the domain's MX records
exists - Match when a DNS A lookup returns an answer

Qualifiers

+ pass - Authorize the matching sender
- fail - Mark nonmatching senders as unauthorized
~ softfail - Treat nonmatching senders as suspicious during rollout
? neutral - Make no positive or negative assertion

DNS lookup limitations

  • One SPF record: A domain should publish exactly one TXT record that starts with v=spf1; multiple SPF records cause a permanent error for receivers.
  • Ten lookup terms: RFC 7208 limits SPF evaluation to 10 DNS-querying terms, including include, a, mx, ptr, exists, and redirect.
  • Provider chains count: Each nested provider include can consume additional DNS lookups, so a short-looking record can still exceed receiver limits.
  • DNS caches can lag: Recursive resolvers may return old TXT answers until TTLs expire, especially after a mail-provider migration.
  • SPF is not DKIM: SPF authorizes an SMTP client for an envelope domain. DKIM from RFC 6376 signs message content, and DMARC decides whether SPF or DKIM aligns with the visible From domain.
  • Forwarding can break SPF: Traditional mail forwarding changes the connecting SMTP client, so forwarded mail often depends on DKIM or forwarding-safe rewriting such as SRS.

Source standards

SPF policy syntax, mechanisms, qualifiers, DNS lookup limits, and result handling are specified in RFC 7208. SPF is published through DNS TXT records using the resource-record model from RFC 1035. SMTP envelope sender behavior comes from RFC 5321, while RFC 8601 defines the Authentication-Results header used to record SPF results.

API Usage Example:

POST /api/tools/network/spf-record-checker
Content-Type: application/json

{
    "domain": "example.com",
    "action": "lookup"
}
Ready