SPF check

Fetches the SPF record, follows include and redirect chains, detects loops and multiple records, and counts DNS-querying mechanisms against the RFC 7208 limit of ten.

Updated 2026-10-07

What this tool checks

The SPF check looks up the TXT record that starts with v=spf1 for the domain you enter and analyses it as a receiving mail server would have to.

It follows include and redirect entries, up to 20 SPF records in the tree.
It counts the mechanisms that cause DNS queries against the limit of 10, and the lookups that return nothing ("void lookups") against the limit of 2 (RFC 7208 section 4.6.4). Void lookups are counted for include and redirect targets only, because a, mx and exists terms are not resolved.
It detects include loops, and domains that publish more than one SPF record.
It flags +all and a bare all, also inside included records, because they allow any sender.
It reports a missing all, ?all and ~all so you can decide whether they are intended.

How to read the result

Each finding has a code, a plain-language message and, where it helps, the entry it refers to. A finding is information about the published record, not a verdict on your mail delivery. The lookup count tells you how close the record is to the limit; a record over the limit is evaluated as a permanent error by receivers, so SPF stops protecting that domain.

Limitations

Macros in SPF records are not evaluated. The check reports that a macro is present.
The result is the policy as published in DNS at the time of the check. It does not evaluate the policy for a given sender IP address.
The check cannot see mail flows. A clean SPF record does not mean that your mail is delivered or authenticated.

Use it from code

API reference for SPF check

curl -i "https://api.probekit.dev/v1/mail/spf?domain=example.com"

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

Input	Domain
Deadline	10 seconds
Freshness	Up to 5 minutes, never longer than the record TTL
Price	$0.01 per check

Findings this tool can report

SPF (13)

Error SPF_INCLUDE_LOOP The SPF chain returns to a domain it already evaluated.
Error SPF_INCLUDE_NOT_FOUND An included or redirected domain has no SPF record.
Info SPF_MACRO_NOT_EVALUATED An SPF record contains macros that were not evaluated.
Error SPF_MULTIPLE_RECORDS More than one SPF record was found for a name in the SPF chain.
Warning SPF_NEUTRAL_ALL The SPF policy ends with ?all.
Warning SPF_NOT_FOUND No SPF record was found for the domain.
Warning SPF_NO_ALL The SPF record has no all mechanism and no redirect.
Error SPF_PASS_ALL The SPF policy ends with +all.
Warning SPF_PTR_MECHANISM An SPF record uses the ptr mechanism.
Info SPF_SOFTFAIL_ALL The SPF policy ends with softfail (~all).
Error SPF_SYNTAX_ERROR An SPF record contains a term that cannot be parsed.
Error SPF_TOO_MANY_LOOKUPS The SPF record needs more than 10 DNS lookups.
Error SPF_TOO_MANY_VOID_LOOKUPS More than two SPF lookups returned no data.

Check (1)

Warning CHECK_QUERY_BUDGET_EXCEEDED The check stopped after reaching its DNS query limit.

DNS (3)

Error DNS_DOMAIN_NOT_FOUND The DNS resolver reported that the domain does not exist.
Warning DNS_RESOLVER_FAILURE The DNS resolver returned a server failure.
Warning DNS_RESOLVER_TIMEOUT The DNS resolver did not answer in time.

Frequently asked questions

Why is my SPF over the 10-lookup limit?

RFC 7208 allows at most ten DNS-querying mechanisms (include, a, mx, ptr, exists, redirect) while an SPF record is evaluated. Every include of a mail service adds to the count, and the services you include can add their own. The check shows the tree so you can see which entry uses the budget.

Is ~all or -all better?

It depends on whether every system that sends mail for the domain is listed. -all asks receivers to reject everything else, ~all asks them to treat it as suspicious. If you are not sure that all senders are covered, ~all is the safer choice while you find out.

Does the check send any email?

No. It only reads public DNS records for the domain you enter.

Can it tell me if a specific IP address may send for my domain?

No. The check analyses the published policy. It does not evaluate the policy for a particular sender IP.