SPF record checker

SPF (Sender Policy Framework) is a TXT record that lists the servers allowed to send email for a domain. When mail arrives, the receiving server checks whether the connecting IP matches a mechanism in the record: ip4 and ip6 list addresses directly, include pulls in another domain's list (how you authorize providers like SendGrid or Google Workspace), and a and mx reference the domain's own DNS entries.

The record ends with an all mechanism whose qualifier sets the default: -all fails unlisted senders, ~all soft-fails them, and ?all does nothing. A missing or permissive all mechanism leaves the domain open to spoofing.

SPF evaluation may perform at most 10 DNS lookups. Every include, a, mx, ptr, exists, and redirect term costs one, and nested includes count too, which is how domains quietly break: each new email vendor adds an include until the eleventh lookup makes every SPF check return permerror.

Fixes include removing unused vendors, flattening includes into ip4 ranges (with tooling to keep them current), or consolidating sending through fewer providers. This checker counts the top-level lookups in your record so you can see how close you are.