SPF check: is your SPF record valid and under the 10-lookup limit?

This tool parses your domain’s SPF (Sender Policy Framework) TXT record with AdminKit’s own code — no third-party mail-auth library — following every include, a, mx, ptr, exists and redirect term it finds, including through nested includes, to count how many DNS lookups evaluating the record actually costs.

Why the lookup count matters

RFC 7208 caps SPF evaluation at 10 DNS lookups specifically to bound the cost of checking a single record. A record that exceeds the limit is treated by receivers as a permanent error (“permerror”) — mail authentication effectively stops working for the whole domain, often silently, until someone notices deliverability dropping. Common causes are stacking too many third-party mail-sending services (include:) without consolidating them.

Reading the “all” mechanism

The trailing all term decides what happens to mail that matches nothing else in the record: -all (fail, reject), ~all (softfail, flag as suspicious), ?all (neutral, no real effect) or +all (pass — meaning anyone can send as this domain, almost always a mistake). No all term at all behaves like ?all.

Limits

• This checks syntax and lookup count, not whether a specific sending IP would pass or fail — that depends on the full mechanism list and is better observed from real delivery reports (DMARC rua).
• No query is logged; see /legal/privacy/.