MailTraceKit.me

SPF · RFC 7208

SPF Record Checker

Look up a domain’s SPF record, see what every mechanism means, and follow each include down the tree to count DNS lookups against the limit of 10.

Lookup

DNS over HTTPS · Cloudflare 1.1.1.1
Try:

How to use the SPF checker

Type a domain, or paste an email address, and press Check SPF. The checker reads the domain’s TXT records, picks out the one that starts with v=spf1 and explains each term. It then follows every include: and redirect=, because the limits in RFC 7208 apply to the whole tree, not just your own record.

Reading the results

  • DNS lookups: include, a, mx, ptr, exists and redirect each cost one lookup. Above 10, receivers return permerror and SPF fails for all of your mail. ip4, ip6 and all cost nothing.
  • Void lookups: terms that point to names with no records. More than two also cause a permerror.
  • The final qualifier: -all fails unlisted servers, ~all soft-fails them, ?all is neutral and +all lets anyone send as your domain.
  • Multiple records: a domain must publish exactly one v=spf1 record. Two records, often one per email service, make SPF fail entirely.

Counting is worst case, as for mail from a server you have not listed. Terms with macros such as %{i} are counted but not expanded. To write a new record, use the SPF record generator.

Frequently asked questions

How do I get under the 10-lookup limit?

Drop includes for services you no longer use, replace a and mx with the ip4 and ip6 ranges they resolve to, drop ptr, and send bulk mail from a subdomain with its own SPF record. Avoid copying a provider’s IP ranges into your record: they change, and a stale copy breaks SPF.

Should my record end in -all or ~all?

Both are fine once DMARC is enforced, because DMARC then decides what happens to failing mail. ~all is safer while you are still finding every service that sends for you; -all is stricter, but some receivers reject on an SPF fail before checking DMARC, which can hurt forwarded mail.

Does SPF protect the From address people see?

Not on its own. SPF checks the envelope sender (the Return-Path), which mail apps do not show. DMARC is what requires SPF or DKIM to match the visible From domain.

Why is the ptr mechanism flagged?

RFC 7208 deprecates ptr: it is slow and some large receivers ignore it. Use ip4, ip6 or include instead.