RFC 7208 recursive evaluation
Validate an IP address against a domain’s SPF record
Enter a domain and an IP address. This tool performs a live DNS lookup of the domain’s
SPF record, recursively resolves every include, redirect,
a, and mx mechanism, and tells you exactly whether the IP is
authorized — with the full reasoning trace.
How the SPF check works
1
DNS TXT lookup
The tool queries the domain's TXT records and finds the one starting with "v=spf1", the SPF record.
2
Recursive evaluation
Each mechanism — ip4, ip6, a, mx, include, exists, ptr — is evaluated in order, following include: and redirect= chains just like a real mail server, up to 10 DNS lookups.
3
Verdict & trace
The first matching mechanism determines Pass, Fail, SoftFail, or Neutral. You get the full trace of every domain and mechanism checked along the way.
Frequently asked questions
- What is an SPF record?
- Sender Policy Framework (SPF) is a DNS TXT record, defined in RFC 7208, that lists which mail servers and IP addresses are authorized to send email on behalf of a domain. Receiving mail servers check this record to help detect forged "From" addresses and reduce spam and phishing.
- How does this tool determine if an IP is authorized?
- It fetches the domain's TXT records, locates the one beginning with "v=spf1", and evaluates each mechanism in order — ip4, ip6, a, mx, include, exists, and ptr — recursively following include: and redirect= references exactly as a receiving mail server would, up to the RFC 7208 limit of 10 DNS lookups. The first mechanism that matches your IP determines the result.
- What do Pass, Fail, SoftFail, and Neutral mean?
- Pass means the IP is explicitly authorized. Fail (a "-all" style result) means it is explicitly not authorized and receiving servers may reject the message. SoftFail ("~all") is a weaker signal typically resulting in the message being flagged or accepted with reduced trust. Neutral ("?all") means the domain owner makes no assertion either way.
- Why did I get a PermError result?
- PermError means the SPF record itself is invalid — for example it contains a syntax error, publishes more than one SPF record, or its chain of include/redirect references requires more than 10 DNS lookups to resolve. A PermError record cannot be reliably evaluated by any mail server.
- Does this tool send any email?
- No. This is a read-only diagnostic tool. It only performs DNS lookups (TXT, A, AAAA, MX, and reverse DNS as needed by the mechanisms in the record) — it never sends, relays, or receives email.