Skip to content
Open Engine
← All analysers
Technical analysis

SPF record analyser

Parse an SPF record, count its DNS lookups, and find what will break it.

Short answer

An SPF record is valid when it starts with v=spf1, appears exactly once on the domain, resolves within ten DNS lookups including everything its includes pull in, and ends with -all or ~all. The lookup limit is what breaks most records: exceeding it returns permerror, which receivers treat as having no SPF at all.

Queries your domain's TXT records over DNS-over-HTTPS and fills the record in below.

Or read it yourself with dig +short TXT example.com and paste the value here. Quoted, multi-string records are joined the way a resolver joins them.

Runs entirely in your browser. The record you paste is never sent to a server, logged, or stored — this page has no backend to send it to. If you use Look up, your browser queries Cloudflare's 1.1.1.1 resolver (Google Public DNS as a fallback) over DNS-over-HTTPS; only the domain name is sent, and only when you ask.

Look up a domain or paste a record to see the findings. Nothing is checked until you do.

How to use it

  1. Enter the domain and press Look up, or read the record yourself with dig +short TXT example.com and paste the string starting with v=spf1.
  2. Read the findings top down; errors break authentication, warnings are hardening.
  3. Fix the lookup count first if it is flagged — a permerror disables SPF for every message.
  4. Look the domain up again after publishing changes to confirm the new value resolves.

Frequently asked questions

Does this tool query DNS for me?

Only when you press Look up. Your browser then asks Cloudflare's 1.1.1.1 resolver (Google Public DNS as a fallback) for the domain's TXT records over DNS-over-HTTPS; the record itself is analysed locally and this site never sees it. Pasting a record sends nothing anywhere.

How accurate is the lookup count?

Terms in the record are counted exactly. Nested includes are counted using the published cost of well-known vendors; an unrecognised include is counted as one, so the real total may be higher. Treat the number as a floor.

Is ~all or -all correct?

Use ~all while you are still finding sending sources in DMARC reports, then move to -all once every legitimate source passes.

Guides that go deeper

More technical analysis

All analysers
Technical analysis

DMARC record analyser

Grade a DMARC record on enforcement, not just syntax.

Runs in your browser
Technical analysis

DKIM key analyser

Check a DKIM public key's strength, revocation state, and tags.

Runs in your browser
Technical analysis

Email header analyser

Read authentication, DMARC alignment, and hop-by-hop delays from raw headers.

Runs in your browser