IPTOOL TR My IP

Email

SPF lookup

Validate the SPF record, policy and include chain.

Daily queries 0 / 40

40 queries left

Sign up → 200/day · Pro → 5000/day Sign up / see Pro

To build a new SPF TXT use SPF Generator.

Queries leave from this Linux server, not your ISP DNS. Free. Cached answers can differ for a short time.

SPF mechanisms (short)

They combine in one v=spf1 string. DNS lookups (include, a, mx, redirect, exists) must stay ≤ 10.

Mechanism Meaning Example
ip4 / ip6 Allow these addresses. ip4:203.0.113.10
include Pull another domain’s SPF (1 lookup). include:_spf.google.com
a / mx Allow A or MX IPs (each is a lookup). a mx
-all Fail everyone else (production). v=spf1 … -all
~all Softfail; monitoring during rollout. v=spf1 … ~all
+all Allow all — never use. avoid

What is SPF and what does this page do?

SPF (Sender Policy Framework) publishes which hosts may send mail for your domain in a DNS TXT record. Receivers compare the sending IP to that list.

IPTOOL fetches v=spf1, splits terms into a table, runs publish/syntax/lookup/loop/PTR/void/policy checks, and shows related DMARC. Queries leave from this Linux host.

Examples

Google Workspace
v=spf1 include:_spf.google.com -allEnough if that is your only SMTP.
Microsoft 365
include:spf.protection.outlook.comAdd your own ip4 on the same line if needed.
Error
two v=spf1 TXT recordsCauses permerror — merge into one.

How to read the result

The green banner is the raw TXT. The top table opens each mechanism as Prefix / Type / Value. Lower tests cover publish, syntax, the 10-lookup limit, loops, PTR, void lookups, and the all policy.

No SPF or +all weakens anti-spoofing. More than 10 DNS lookups yields permerror. Start with ~all while you collect sources, then move to -all.

Examples

Good
one TXT · -all · ≤10 lookupsProduction target.
Fix
+all or 12 includesNarrow first, then -all.

Frequently asked questions

What is SPF?

A DNS TXT record that names which IPs may send mail for your domain. Missing SPF raises spoofing risk.

Which policy should I use?

Start with ~all while you inventory sources, then switch to -all. Never use +all.

Why does the include limit matter?

SPF allows at most 10 DNS lookups. Too many includes yield permerror and mail fails.

Will mail still send without SPF?

It can, but receivers treat it as easy to spoof. DMARC alignment also weakens.

What is the Google Workspace include?

include:_spf.google.com. Microsoft 365 often uses spf.protection.outlook.com.

Record too long?

Stay under 255 characters; split with include and keep the 10-lookup rule.

What does redirect= do?

It points the whole policy at another domain’s SPF. Easier one-record setups; still check alignment.