SPF Record Checker

Inspect published or draft SPF policy syntax, DNS dependencies, lookup limits, void evidence, and remediation without creating an account.

RFC 7208 HEALTH CHECK

Policy input

Analysis source Published DNS record Draft/source record

Domain

A domain, email address, or URL is accepted. Only its DNS hostname is used; internationalized names are converted to A-label form.

Recursive resolver

DNS evidence depth

Protocol mode asks the backend for extra transport evidence and can be much slower.

Follow static include and effective redirect targets Use remaining request budget to probe static a, mx, and exists targets

Deterministic source example

What this checker proves

It checks record health and gathers bounded public DNS evidence. It does not decide whether a particular SMTP client passes SPF unless the client IP, MAIL FROM, HELO, macro expansion context, DNS timing, and receiver behavior are all known.

Lookup accounting

include, a, mx, ptr, exists, and effective redirect consume the shared 10-term SPF budget when evaluated.
The checker reports a structural expanded count and completed DNS evidence separately. First-match behavior can make a real sender-specific count lower.
More than two void DNS results can produce permerror; voids are contextual when an IP family or macro value is missing.

Privacy & dependencies

Published checks send normalized names, record types, depth, and the chosen resolver to Octetify’s same-origin DNS analyzer. Draft text remains in this page, except static referenced domains when follow-up checks are enabled. No browser storage is used. Share links place settings in the URL fragment, which browsers do not send in HTTP requests.

Service limits

A run is sequential and capped at 12 analyzer requests. Large graphs, macro targets, PTR work, MX address fan-out, timeouts, or quota responses can leave evidence unresolved. The checker labels that state and never fills gaps with invented results.

Primary references: RFC 7208 (SPF), RFC 8616 (internationalized mail authentication), and RFC 9989 (DMARC).

SPF Record Checker

Policy input

Analysis result

Actionable findings

Selected policy and parsed terms

Dependency and lookup-budget map

DNS evidence and probe outcomes