Web Security

SPF Record Explainer

Explains each SPF mechanism and counts the DNS lookups against the limit of ten that makes a record fail.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Paste the SPF TXT record value, starting with v=spf1.
  2. Select Explain SPF.
  3. Check the DNS-lookup count near the bottom - staying under ten is what keeps the record from failing.
  4. Confirm the record ends in -all or ~all; a missing or +all ending is worth fixing.

What spf record explainer does

SPF has one trap that turns a working record into a broken one without any obvious change: the ten DNS-lookup limit. Every include, a, mx, ptr and exists costs a lookup, and an include can pull in more than you think. Cross the limit and the check returns permerror, which most receivers treat as a fail - so mail that flowed yesterday bounces today.

Paste the TXT record value and this translates each mechanism, explains the final "all" qualifier in plain terms, warns on the dangerous +all and the deprecated ptr, and counts the DNS-querying mechanisms so you can see how close the record sits to the limit. The count is static - it counts what is in the record, not what each include expands to, because it never performs the lookups. It runs entirely in your browser - nothing you paste is sent anywhere, and this tool does not contact, scan or attack any website. Only review systems you own or are authorised to assess.

Frequently asked questions

SPF allows at most ten mechanisms that require a DNS lookup - include, a, mx, ptr and exists. Go over and the evaluation returns permerror, which most receivers treat as a failure. It is the most common reason a previously working SPF record starts bouncing mail.

No - it is a static estimate. It counts the querying mechanisms in the record as you pasted it. Each include can expand into more lookups when it is resolved, which this tool cannot see because it never performs the lookups. Treat the number as a floor.

A qualified all mechanism. -all fails unmatched senders and is the strict, recommended ending for a complete record; ~all soft-fails them and is common during rollout. +all passes everyone and is almost always a mistake.