SPF checker

What this checks

• Exactly one v=spf1 record
• Valid mechanisms, macros and exp= (read, not expanded)
• What -all, ~all, ?all and +all mean for your business
• Dangerous endings (+all, ?all) and deprecated ptr
• DNS lookups counted through every include and redirect against the limit of 10, with loop protection
• Empty (void) lookups, over-long records, and includes that point at a domain that no longer publishes SPF

How to use it

1. Enter your domain.
2. Fix duplicate or invalid records first.
3. Add every service that sends mail as you (mailbox provider, newsletter tool, invoicing).
4. End with -all once you are confident the list is complete.

Methodology and limitations

Lookups are counted by following includes with a fixed cap on DNS queries; if the cap is reached the count is shown as “or more”. Macros are read but not expanded. PixelPrivate performs passive checks against publicly visible configuration only. It does not test for exploitable vulnerabilities, so a clean result is not a guarantee of security. Read the full security methodology.

Key terms

• SPF — SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send email on behalf of your domain..
• DMARC — DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with email that claims to be from your domain but fails SPF and DKIM checks..