How to use it
- Read the record from DNS:
dig +short TXT example.comand take the string starting with v=spf1. - Paste it into the analyser and read the findings top down; errors break authentication, warnings are hardening.
- Fix the lookup count first if it is flagged — a permerror disables SPF for every message.
- Re-query DNS after publishing changes and paste the new value to confirm.
Frequently asked questions
Does this tool query DNS for me?
No. It analyses the record you paste, so nothing you enter leaves your browser. Fetch the record with dig or your DNS provider's console first.
How accurate is the lookup count?
Terms in the record are counted exactly. Nested includes are counted using the published cost of well-known vendors; an unrecognised include is counted as one, so the real total may be higher. Treat the number as a floor.
Is ~all or -all correct?
Use ~all while you are still finding sending sources in DMARC reports, then move to -all once every legitimate source passes.