SPF Record Checker

Inspect Sender Policy Framework (SPF) records on target domains to audit authorized mail servers and detect spoofing vulnerabilities.

How It Works

1. Provide a target domain hostname.
2. The tool fetches TXT records matching the v=spf1 version specifier.
3. The policy structure, include chains, and active IP/CIDR ranges are parsed and checked for syntax compliance.

Primary Use Cases

• Validating which IP addresses and subnets are authorized to send email for a domain.
• Detecting malformed or invalid SPF configurations that break email delivery.
• Auditing third-party email provider inclusion lists.

Common Security Pitfalls

• Creating multiple SPF TXT records on a single domain (which invalidates SPF validation completely).
• Exceeding the limit of 10 recursive DNS lookups inside the SPF include mechanisms.

Frequently Asked Questions

What is the difference between ~all and -all?

~all specifies a SoftFail (emails failing check are marked/flagged but accepted), while -all specifies a HardFail (emails failing check should be rejected outright).

What is the 10 DNS lookup limit?

SPF specifications restrict policy evaluation to a maximum of 10 recursive DNS lookups (caused by includes, mx, a, exists redirects) to prevent DDoS abuse on name servers.

References & Standards

• RFC 7208: Sender Policy Framework