Free · without registration
Checking SPF Record and Nested Includes
Read the published SPF record of your domain. The checker follows include and redirect references, detects loops and shows striking mechanisms – without sending a test mail.
Start of test
Their results
What an SPF Record Determines
SPF describes which servers can send e-mails for a specific Envelope sender domain. The TXT record starts with v=spf1 and can contain IP networks as well as references to shipping services. Enter the domain from the technical mail sender; it does not have to match the From address visible to recipients. The assignment to the visible domain becomes relevant only by DMARC.
Understanding Includes and Lookup Limit
include loads another SPF rule, redirect passes to another policy. Both may contain further references. The checker follows these rules up to a fixed test limit and marks cycles. SPF allows a maximum of ten DNS-triggering terms in the actually evaluated path. The displayed static sum of the examined tree is an orientation: a hit can end earlier, and MX/PTR sub-queries have additional rules. Without a specific sender IP, a complete SPF result is not simulated.
Correct Typical Errors
Multiple separate TXT records with v=spf1 are not the solution for multiple shipping services: their rules must be merged into one SPF record. An empty or invalid include reference, erroneous IP prefixes or a recursive reference can interfere with the check. +all allows all senders and should not be understood as a restrictive policy. Do not remove old services until they actually stop sending legitimate emails.
What a valid record does not prove
A syntactically plausible record confirms neither deliverability nor DKIM signatures. Macros need information about a specific message and remain visible here as an open check. DNS timeouts are not displayed as missing records. The foundations of mechanisms and limitations are in RFC 7208. For a full mail configuration, SPF, DKIM and DMARC should be considered together.
Example of classification
v=spf1 include:_spf.example.org -all delegates part of the check and ends unsuitable senders with fail. Two separate v=spf1 records for the same domain, on the other hand, are an error.
Frequent questions
Does the checker send an email?
No. It reads public DNS records via Google Public DNS.
Is the number of DNA mechanisms a complete SPF test?
No. It's a static view of the rule tree under study. A real evaluation requires, among other things, a sender IP and can end earlier.
Why does a macro remain open?
Macros can depend on sender, IP or HELO. This information is not available for a pure domain check.