SPF / DMARC Record Checker

RFC 7208 caps a single SPF evaluation at ten DNS lookups. Each include, a, mx, ptr, exists and redirect spends one. ip4 and ip6 spend none. Past the cap the result is permerror, which makes SPF useless at most receivers.

No. It counts only what the record you pasted spends by itself. Every include: target spends lookups of its own, so the real total is always higher. Without querying DNS this is the most that can be known, so read the number as headroom rather than a verdict.

-all (fail) states that nothing outside the listed sources is yours. ~all (softfail) says it probably is not, without committing. The usual path is to run ~all until you are sure nothing legitimate is missing, then move to -all.

It authorises every IP address in the world. That is not a configured SPF record, it is a disabled one, and it removes the protection entirely. It is most often left behind after a test.

p= is the policy for the domain itself and sp= is the policy for its subdomains. With no sp= the subdomains inherit p=, so writing sp=none deliberately loosens the subdomains.

No. It checks the syntax of the text you paste. It therefore cannot follow include: chains, and it cannot confirm that the record is actually published.

Exactly one. Two or more TXT records starting with v=spf1 on the same domain produce a permerror. To authorise another sender, add an include: to the existing record rather than publishing a second one.

Yes. RFC 7208 section 5.5 deprecates it. It depends on reverse DNS, which is slow and unreliable, and it still spends a lookup. Replace it with ip4 or include.

The policy applies to that share of messages and the rest are treated one step more leniently. It exists to stage a move towards reject, not as a permanent setting.

No. The check runs entirely in your browser and nothing is sent to or stored on a server.