H
HTTPSense

SPF Inspector

Check and validate Sender Policy Framework records — expand includes, count DNS lookups, and catch misconfigurations.

What is an SPF Inspector?

An SPF inspector is a tool that checks a domain's Sender Policy Framework record — the v=spf1 TXT record that tells receiving mail servers which hosts are allowed to send email on the domain's behalf. SPF is a domain-level control defined in RFC 7208: the path of a URL does not matter, only the registered domain. Getting it right is essential for email deliverability and for preventing spoofing of your domain.

HTTPSense's SPF Inspector resolves the record, parses every mechanism and modifier, and recursively expands include and redirect chains so you can see exactly how many DNS lookups your policy consumes against the RFC 7208 limit of ten. It surfaces problems like multiple SPF records, +all open relays, soft-fail and neutral qualifiers, void lookups, and lookup-limit overflows — then assigns a letter grade. It's free and requires no signup.

How to Use the SPF Inspector

  1. Enter a domain name or URL in the search bar and click Inspect SPF.
  2. Review the Summary tab for the record, the all qualifier, the DNS lookup count, and the overall grade.
  3. Open the Mechanisms tab to see each parsed term, its qualifier, and whether it consumes a DNS lookup.
  4. Use the Expansion Tree tab to follow every include and redirect chain and find which one pushes you over the limit.
  5. Check the Findings tab for severity-ranked issues and concrete remediation steps.
  6. Use the Raw tab to copy or download the full JSON response.

How the SPF Inspector Works

When you submit a domain or URL, we strip the scheme, port, and path to extract the bare hostname and query its TXT records through Cloudflare's public resolver (1.1.1.1). We select the record beginning with v=spf1, flag the error if more than one exists, and report no_record when none is found.

The record is tokenised against the SPF grammar and each mechanism is classified. We then expand the policy left-to-right per RFC 7208: include and redirect pull in and recursively parse another record, while a, mx, exists, and ptr each consume one of the ten permitted DNS lookups. ip4 and ip6 cost nothing. Lookups that resolve to nothing are tallied as void lookups against the limit of two, and circular include chains are detected and stopped.

Finally we evaluate a findings catalog — multiple records, lookup-limit overflow, void excess, open +all, missing all, soft-fail and neutral qualifiers, deprecated ptr, oversized records, and more — and translate them into a 0–100 score and an A–F grade. We do not send any email or probe SMTP; the analysis is purely DNS-based.

Key Features

  • Recursive include expansion — Follows every include and redirect chain and renders it as a tree.
  • 10-lookup budgeting — Counts DNS-consuming mechanisms in real time and flags permerror overflows.
  • Void-lookup detection — Tallies dead a/mx/exists/include targets against the two-void limit.
  • Qualifier analysis — Grades the terminal all qualifier and catches dangerous +all open relays.
  • Findings & remediation — Severity-ranked issues, each with a concrete fix.
  • Scored grade — A 0–100 score mapped to an A–F grade for at-a-glance health.
  • Raw JSON output — The complete response for scripting, monitoring, or documentation.

Common Use Cases

  • Email administrators — Confirm the policy stays under ten lookups before adding another email provider.
  • DevOps engineers — Audit SPF as part of onboarding a new ESP or migrating mail platforms.
  • Security engineers — Catch +all and ?all mistakes that leave a domain spoofable.
  • Deliverability specialists — Diagnose silent permerror failures hurting inbox placement.

Frequently Asked Questions

What is the SPF 10-lookup limit?

RFC 7208 caps the number of DNS-querying mechanisms (include, a, mx, ptr, exists, and redirect) at 10 after full expansion. Exceeding it causes a permerror, which most receivers treat as if SPF were not configured. The Inspector recursively expands every include and shows the running lookup count so you can stay under the limit.

What does the all qualifier mean?

The all mechanism is the catch-all at the end of an SPF record. -all (hard fail) rejects every sender not otherwise listed, ~all (soft fail) marks them suspicious, ?all (neutral) asserts nothing, and +all authorises everyone — which is dangerous and should never be used. The Inspector grades the qualifier accordingly.

What is a void lookup?

A void lookup is an a, mx, or exists mechanism (or an include target) that resolves to no records or NXDOMAIN. RFC 7208 limits void lookups to two; more than that is a permerror. Void lookups usually point to dead ESPs or typos in the record.

Does this replace DKIM and DMARC?

No. SPF is one of three core email-authentication mechanisms. DKIM signs messages and DMARC ties SPF and DKIM together with a published policy. The SPF Inspector focuses on SPF; dedicated DKIM and DMARC inspectors are also available on HTTPSense.

Is it free? Do I need to sign up?

Yes, the SPF Inspector is free and requires no signup or API key.