SPF validator: does this record's syntax and lookup count hold up?

Paste an SPF TXT record below and AdminKit checks its syntax, counts the DNS-lookup-causing terms it contains against RFC 7208’s limit of 10, and explains its qualifiers — entirely offline. It never queries DNS or follows an include/redirect chain, which is why it reports the lookup count in this record only; a record that looks fine here can still exceed the limit once nested includes are resolved.

What it checks

• Version tag — whether the record starts with the required v=spf1 term, as RFC 7208 §4.5 requires.
• Lookup-causing term count — how many include, a, mx, ptr, exists and redirect terms appear in this record, against RFC 7208 §4.6.4’s hard cap of 10, counted the same way Microsoft documents in its own SPF setup guide.
• Qualifiers and flags — the +, -, ~ and ? qualifier on each mechanism, and the trailing all term’s effect (fail, softfail, neutral or pass).
• Syntax findings — a severity-ranked list of specific issues found (for example a missing version tag, a malformed term, or too many lookup-causing terms), each citing the offending term where one exists.

Why “this record only” matters

Six mechanism types cost a DNS lookup under RFC 7208 §4.6.4: include, a, mx, ptr, exists and redirect — and include/redirect can each point at another record with its own lookup-causing terms nested inside. Because this tool never resolves DNS, it counts only the terms visible in the text you paste; it has no way to see what a nested include adds. Microsoft’s own guidance on this exact limit puts it plainly: “having fewer than 10 include: statements doesn’t guarantee fewer than 10 DNS lookups.” A record this check marks valid can still fail in production once every include is followed — that fully-resolved count is what the live SPF check reports instead.

Limits

• No DNS lookups are performed, ever — this reads the record text only, so it cannot confirm the record you paste is what a domain actually publishes, or that an include/redirect target even exists.
• The lookup-term count is for this record alone; see the SPF check for the fully-resolved count after every nested include and redirect is followed.
• It does not evaluate whether any specific sending IP address would pass or fail against the record.

See what an SPF check result actually means for how a fully-resolved result is interpreted, fixing SPF “too many DNS lookups” (PermError) for what to do if a record is over budget, and the glossary entry for SPF for the short definition. SPF is one of three records mail authentication relies on — see SPF, DKIM and DMARC explained for how it combines with the other two, and how AdminKit’s checkers compare to other free options in the free SPF/DMARC checker roundup.