SPF Record Checker
SPF (Sender Policy Framework, RFC 7208) uses DNS TXT records to declare which server IPs are authorized to send mail for your domain. The receiving MTA queries the sender domain’s SPF record and compares the connection source IP to decide if the sender is authorized. SPF is the first line of the email authentication trio (SPF/DKIM/DMARC); misconfigurations (e.g. too many includes exceeding the lookup limit) can cause legitimate mail to be rejected or bounced with 554.
Enter a domain (e.g. example.com); the tool resolves its TXT records and locates the SPF record (starting with v=spf1).
Features
- Real-time DNS lookup: TXT queries via DNS-over-HTTPS (DoH) to a public resolver, independent of local DNS cache
- Mechanism breakdown: splits the SPF record into ip4/ip6/include/mx/a mechanisms and + - ~ ? qualifiers, explaining each
- 10-lookup limit check: counts DNS lookups for include/mx/a per RFC 7208 §4.6.4 and warns about permerror when exceeded
- Missing-record detection: auto-identifies missing SPF records, wrong version prefixes, missing all modifier, and other common issues
How to Use
Enter a domain (e.g. ztpop.net) and click “Check SPF”. The tool queries the domain’s TXT records via DoH, filters records starting with v=spf1, and parses each mechanism. If no SPF record exists it warns “No SPF record found” with configuration advice. Below the result it also estimates DNS query count, helping you judge how close you are to the RFC 7208 10-lookup limit.
Why Check Regularly
SPF (Sender Policy Framework) is the first line of email authentication: it declares which servers are allowed to send mail for your domain. A missing or misconfigured SPF record is one of the top reasons mail is classified as spam or bounced by receivers.
Per RFC 7208, after receiving a message the receiving system queries the sender domain’s SPF record and compares it with the actual connection IP. A failed lookup (no record) or failed comparison (unauthorized IP) yields an authentication result of fail, triggering the receiver’s anti-spam policy.
Checking SPF regularly helps you catch lost records (e.g. after DNS migration), mechanism errors (e.g. wrong ip4 ranges), and the most subtle problem — exceeding the 10-lookup DNS limit, which makes the SPF result permerror, effectively invalidating the entire record.
Interpreting Results
| Result | Meaning | Risk Level |
| pass | Sending IP is in the SPF allow list; authentication passed | None |
| fail / hardfail | Sending IP is explicitly unauthorized; reject or quarantine | High |
| softfail | Sending IP not authorized but policy is lenient (~all) | Medium |
| neutral | Record exists but no explicit policy declared (?all) | Medium |
| permerror | Syntax error or DNS lookup limit exceeded; whole record invalid | High |
| temperror | Temporary DNS failure; retry later | Low |
| none | No SPF record for the domain | High |
Common Misconfigurations & Fixes
- No SPF configured：Add a TXT record; minimal config v=spf1 mx ~all authorizes only MX servers
- Missing all modifier：SPF must end with -all / ~all / ?all; otherwise the policy is incomplete and spoofing is possible
- 10-lookup limit exceeded：Each include adds lookups; over 10 (RFC 7208 §4.6.4) requires merging or simplifying mechanisms
- Wrong ip4 range：Confirm the sender’s public IP matches the record; list all IPs for NAT/multi-line setups
- Mismatch with DKIM/DMARC：SPF only covers the sending identity; combine it with DKIM signing and DMARC policy for a complete authentication chain
Technical Standards
This tool follows the IETF standards below; lookup and parsing logic match the RFC definitions:
- DNS lookup: RFC 8484 (DNS Queries over HTTPS), RFC 1035 (DNS protocol)
- Record parsing: SPF parsing: RFC 7208 §4 (mechanisms & modifiers), §4.6.4 (DNS lookup limit)