Free Tool · SPF
SPF Inspector
Expand a domain's SPF record, walk every include, and count both limits that make SPF fail — the 10 DNS lookups everyone knows about and the 2 void lookups almost nobody checks.
Free · no signup · reads public DNS only ·
What the SPF Inspector checks
SPF is a TXT record listing which servers may send mail for your domain. A receiving server evaluates it against the IP that actually connected, and the result feeds DMARC.
Two separate limits in RFC 7208 §4.6.4 can make that evaluation fail outright, and exceeding either produces a permerror — which fails SPF for your legitimate mail, not just for spoofers.
Ten DNS lookups. Every include, a, mx, ptr, exists and redirect costs one, recursively through everything they reference. ip4 and ip6 are free. Adding one more SaaS sender is usually what tips a domain over.
Two void lookups. A void lookup is one that returns nothing — NXDOMAIN, or an empty answer. Three of them is a permerror on its own, even if you are comfortably under ten total. These almost always point at a service you stopped using, and because the record still looks short, they are genuinely hard to spot.
We also check the terminal mechanism. A record ending in +all authorises every host on the internet to send as your domain, which is worse than publishing nothing at all — and we check for duplicate records, which RFC 7208 §4.5 makes a permerror regardless of what either one says.
Frequently asked questions
What counts as a DNS lookup?+
Each include, a, mx, ptr, exists and redirect term costs one, recursively through every record they reference. ip4 and ip6 cost nothing, which is why flattening a record into explicit IP ranges brings the count down.
What is a void lookup?+
A DNS query made during SPF evaluation that returns nothing — either NXDOMAIN or an empty answer. RFC 7208 §4.6.4 allows two. The third is a permerror, independently of the ten-lookup count, so a short record can still fail this way.
What happens if I exceed a limit?+
A conforming receiver returns permerror and treats SPF as failed. That hurts deliverability for mail you actually sent, and it breaks DMARC alignment on the SPF side, leaving you relying on DKIM alone.
Should I use -all or ~all?+
Use ~all (soft fail) while you are still discovering senders, then move to -all once your DMARC aggregate reports show everything legitimate passing. Never +all: it authorises the whole internet.
Is flattening safe?+
It works, but it is a maintenance commitment rather than a fix. Your providers change their IP ranges, and a flattened record that has gone stale fails closed. If you flatten, it needs to be re-generated automatically.
Check something else
- DMARC Inspector
Can someone send mail as my domain right now?
- DKIM Inspector
Is my DKIM key actually published, and is it strong enough?
- DNSSEC Analyzer
Is my zone signed, is the chain actually complete, and are the signatures fresh?
Understand it, then fix it
- The SPF 10-lookup limit
How the protocol behaves, and why.
- SPF flattening trade-offs
How the protocol behaves, and why.
- SPF Flattening
Step by step, in the CertaDNS dashboard.
- Email Authentication
What we automate, and what it costs.
- All free tools
Every check we publish, in one place.