[{"data":1,"prerenderedAt":42},["ShallowReactive",2],{"$f2jd0qmyotemsk":3},{"title":4,"seoTitle":5,"description":6,"route":7,"kind":8,"toolKey":9,"intro":10,"indexable":11,"sections":12,"related":39},"SPF Checker","SPF Checker | nslookup.online","Inspect SPF TXT records, syntax, address CIDRs and include\u002Fredirect dependencies with query evidence and explicit static-analysis limitations.","\u002Fspf-checker\u002F","tool","spf","Read SPF syntax and DNS dependencies without inventing a sender verdict.",true,[13,20,26,32],{"id":14,"title":15,"paragraphs":16,"code":19},"read-answer","Start with the sender domain",[17,18],"Enter the domain whose published SPF configuration you want to inspect. The checker selects v=spf1 candidates from TXT records, preserving resource-record boundaries. More than one candidate is a configuration problem.","The first version performs static configuration analysis. It does not accept a sender IP, MAIL FROM or HELO identity and cannot decide whether a particular sending host is authorized.","example.com. 300 IN TXT \"v=spf1 include:mail.example -all\"\n\nDOCUMENTATION EXAMPLE — not a live DNS response",{"id":21,"title":22,"paragraphs":23},"dependencies","Follow include and redirect evidence",[24,25],"The checker follows literal include and redirect domains, detects clear cycles and preserves the DNS queries made along the way. redirect is not applied when an all mechanism is present.","Operations have a product request budget, depth limit and time limit. Reaching a safety limit is reported as incomplete, not as a successful analysis or proof that a domain has exceeded a protocol limit.",{"id":27,"title":28,"paragraphs":29},"limits","Lookup terms are not browser requests",[30,31],"RFC 7208 limits DNS-causing terms on an evaluated SPF path. The number of HTTP requests made by this browser and the number of terms found across a static dependency graph are different measurements.","A graph can contain branches that a real sender never reaches. A static total above ten is a risk observation, not a claim that every message must return PermError. Runtime void-lookup behavior and address matching require sender context.",{"id":33,"title":34,"paragraphs":35},"questions","Interpreting all and unsupported paths",[36,37,38],"-all expresses fail intent for unmatched senders; ~all expresses softfail intent and is not automatically an error. +all permits all senders and should be understood carefully. None guarantees delivery or inbox placement.","IP literal CIDRs and common mechanism\u002Fmodifier syntax are checked. Complex macro-dependent paths are marked incomplete rather than expanded with fictional sender details. ptr is discouraged; this tool does not simulate its sender-IP evaluation.","The checker never automatically flattens SPF or produces a record that you should publish without review. Keep the original configuration and verify changes using your actual sending services.",[40,41],"\u002F","\u002Fguides\u002Fnslookup-command\u002F",1792661399017]