IT Buddy
Menu
NetworkingSecurityCloudLinux & DevOpsUtilitiesMicrosoft Soon
All toolsMy toolsWhat's newAbout

SPF analyzer

Check an SPF record: lookup count against the limit of 10, include chain, -all vs ~all and risky IP ranges. Look it up in DNS or paste records.

Runs in your browser · nothing is sentEmail securityNew

A look-up sends only the domain name and the record type to Cloudflare’s DNS service (cloudflare-dns.com). Nothing else leaves your browser. Choose “Paste records” to stay fully offline.

How to use

  1. Enter your domain, for example example.com.
  2. Select Check. The tool reads the SPF record and follows every include.
  3. Read the findings from the highest severity down and fix the record at your DNS provider.

Common scenarios

Mail from a new service is rejected

Adding another include can push the record over 10 lookups. Check the count before you publish the change.

Moving to a stricter policy

Make sure every sender is listed before you change ~all to -all, then check your DMARC policy.

DMARC analyzer →

About this tool

Enter a domain to read its SPF record from DNS, or paste the records to stay offline. The tool follows every include and redirect, counts the DNS lookups against the limit of 10, draws the tree and lists problems with advice on how to fix them. SPF only checks the sending server, so combine it with DKIM and DMARC for real protection against spoofing.

🔒 Your input stays in your browser and is never sent anywhere.

Frequently asked questions

What is the limit of 10 DNS lookups in SPF?

Every include, a, mx, ptr, exists and redirect in an SPF record, including those inside included records, counts as one lookup. Above 10 the receiver returns a permanent error and SPF fails. Remove unused includes or replace them with ip4 and ip6 ranges.

Should I end with -all or ~all?

-all tells receivers to reject mail from servers that are not listed. ~all marks it as suspicious but still accepts it. Use ~all while you are still finding all senders, then switch to -all. With a strict DMARC policy, ~all is also common.

Is my domain sent to a server?

In “Look up in DNS” mode only the domain name and the record type go to Cloudflare’s DNS service. In “Paste records” mode nothing is sent at all.

What to do next

Also useful

  • DNS lookupLook up A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records for any domain, directly from your browser.

Found a problem or have a suggestion? Tell us