ipyellow

SPF checker

RFC 7208 analysis

Inspect a domain's sender policy, recursively expand referenced policies, and estimate its worst-case DNS lookup use.

Expansion is capped at 20 domains, 10 levels, and eight seconds. DNS answers use the fixed Cloudflare resolver and its bounded cache.

Enter a mail domainThe checker distinguishes missing, duplicate, unsafe, over-limit, and inconclusive policies.

What the lookup count means

SPF permits at most 10 DNS-triggering mechanisms and modifiers during one evaluation. This checker follows static include and redirect references and reports a conservative worst-case count; macro-dependent branches cannot be statically expanded.

Expanded address mechanisms are evidence, not a generated policy to publish. Replacing dynamic SPF references with a static “flattened” record can change semantics and becomes stale when a provider changes its sending ranges.

Back to tools