SPF Checker & Record Validator

The SPF Checker analyzes a domain's public Sender Policy Framework (SPF) DNS record to verify which mail servers and IP addresses are authorized to send email on its behalf. It verifies compliance with RFC 7208 standards, flags syntax errors, and detects common configuration traps.

Crucially, it recursively traces all `include:` mechanisms to calculate the total number of DNS lookups required. If an SPF record requires more than 10 DNS lookups, receiving mail servers automatically throw a `PermError`, causing legitimate outbound emails to fail delivery or get marked as spam.

To prevent Denial of Service (DoS) attacks where a malicious SPF record forces receiving mail servers to recursively resolve endless DNS queries, RFC 7208 strictly limits the number of mechanisms and modifiers that cause DNS lookups to ten (10). These mechanisms include `include:`, `a`, `mx`, `ptr`, and `exists`.

In modern enterprise environments, companies routinely use multiple SaaS services: Google Workspace, Microsoft 365, Zendesk, Salesforce, HubSpot, and SendGrid. Each vendor instructs the customer to add an `include:` mechanism, which often contains nested sub-includes. Within just 3 or 4 vendors, the 10-lookup threshold is easily exceeded. Organizations must "flatten" their records by resolving third-party domains into direct `ip4:` and `ip6:` CIDR blocks to avoid email delivery failures.