SPF Lookup
Look up and analyze a domain's SPF record for common misconfigurations.
What is SPF Lookup?
Sender Policy Framework (SPF) is a DNS TXT record that lists which mail servers are authorized to send email on behalf of your domain. Receiving mail servers compare the sender's IP address against that list and treat unmatched senders according to the record's trailing qualifier, such as -all (reject), ~all (softfail), or +all (allow anything). The record is evaluated under a strict limit of 10 DNS lookups imposed by RFC 7208, so nesting too many include: mechanisms causes the check to fail outright. Correctly configured SPF improves deliverability and is one of the three foundations, alongside DKIM and DMARC, that major mailbox providers now expect for trustworthy mail.
How to Use SPF Lookup
- Type a domain name (e.g. yourcompany.com) and click "Look up".
- The tool fetches the domain's TXT records via DNS-over-HTTPS and finds the one starting with "v=spf1".
- Each mechanism in the record is listed, along with the DNS lookup count and what the trailing "all" mechanism means.
- Any common misconfigurations — missing "all", "+all", too many DNS lookups, or multiple SPF records — are flagged with a plain-language explanation.
Examples
Well-formed record
Input: v=spf1 include:_spf.google.com ~all
Output: 1 DNS lookup, softfail on unlisted senders — no warnings
Common misconfiguration
Input: v=spf1 +all
Output: Warning: any server can send mail as this domain
Common Mistakes
- Publishing more than one SPF TXT record for the same domain — only one is allowed; having two makes evaluation undefined.
- Using +all either by copying an example without reading it, or misunderstanding it as "allow all our servers" rather than "allow literally any server".
- Adding include: for every email tool ever used and never removing old ones, quietly approaching (or exceeding) the 10-lookup limit over time.
Why Use This Tool
- Parses the real record and explains exactly what it means, not just whether one exists.
- Counts DNS lookups against the actual RFC 7208 limit, catching a failure mode that's invisible just by reading the record.
- Flags multiple-record and +all misconfigurations with plain-language explanations.
- Runs the lookup server-side via DNS-over-HTTPS, so it works the same regardless of your own network's DNS behavior.