How to use the spf record parser
- Copy the TXT value of the domain’s SPF record and paste it in the first box.
- If the record has include or redirect terms, paste the records of those domains below, one per line as domain, a colon and the record.
- Read the headline count of DNS lookups and the table of terms.
- Fix any term flagged as a problem and check the count again.
Formula
lookup terms: include, a, mx, ptr, exists and the redirect modifier, one each
ip4, ip6 and all cost no lookups
total = lookups in the record + lookups in every pasted included record, through any depth
RFC 7208 allows at most 10 lookup terms while a receiver checks the record. Going over makes the check fail. Terms after an all term are never reached and cost nothing.
A record with two includes
The record v=spf1 ip4:192.0.2.0/24 include:_spf.mail.example mx include:spf.news.example ~all has two includes and an mx, so 3 lookups on its own. The pasted record for _spf.mail.example adds an include of relay.mail.example (1 lookup), and the pasted record for relay.mail.example adds an a term (1 more). The total is 5 of 10.
The record for spf.news.example is not pasted, so the page cannot count what is inside it and says so. Pasting it can only raise the count.
Why the limit exists
Every lookup is a DNS query that the receiving server must make while accepting a message. The standard caps them at 10 so that a record cannot make a receiver do an unbounded amount of work. A record that goes over is treated as a permanent error by receivers, and your mail can fail the check.
The mx mechanism can also trigger up to 10 address lookups for the mail servers it finds. Those are not in the count shown here, so a record near the limit with an mx term needs extra care.
What the page cannot see
A web page cannot make DNS queries without sending your domain to a server, so this page does not. It works on the text you paste. Records that you do not paste are reported as missing, and their lookups are not counted.
The page checks syntax and counts lookups. It does not know whether the right servers are listed. Test real mail with your provider’s tools once the record looks right.
Assumptions and limits
- The record is pasted text, and no DNS query is made.
- Included records you do not paste are reported as missing and are not counted.
- The mx address lookups and void lookups are not counted.
- Terms after an all term are shown as ignored and cost no lookups.
- Nothing you type is stored or sent anywhere.
Frequently asked questions
What is the difference between ~all and -all?
The first is a soft fail, which tells receivers to treat unlisted senders with suspicion. The second is a hard fail, which asks receivers to reject them. The page names each qualifier in the table.
Why is ptr discouraged?
It needs slow reverse DNS lookups and gives weak results, so the standard says it should not be used. The page flags it and still counts it as a lookup.
Does a redirect count as a lookup?
Yes, once, and the record it points to is then read in place of the rest of the record. A redirect is ignored when the record also has an all term.
How can I get under the limit?
Replace include chains with ip4 and ip6 ranges where you can, drop providers you no longer use and remove ptr and unneeded a and mx terms. Each of these saves lookups.