ToolsEmail

SPF checker

See which servers may send email for a domain. Every include and redirect is followed, DNS lookups are counted against the limit of ten, and each part of the record is explained. You can also check a record before you publish it, or test one sending server.

Records checked in your browser
DNS queries sent via abbott.cloud to Cloudflare

Check

What to check

A domain Would this server be allowed? A record you paste

Domain

You can paste a web address or email address; only the domain is used.

How this works

Your browser asks for the domain's TXT records and picks the one that starts with v=spf1 (RFC 7208 §4.5).
Browsers can't send DNS packets, so each batch of questions goes to abbott.cloud/api/dns, which forwards the packets unchanged to Cloudflare's resolver (1.1.1.1) using DNS over HTTPS (RFC 8484). The answers come back as raw packets and are decoded here.
The page follows every include and redirect, and looks up the A, AAAA and MX records that a and mx name. Questions found at the same level go together in one request.
Everything else happens on your device: reading each record against the grammar in RFC 7208 §12, counting DNS lookups and void lookups (§4.6.4), and working out which addresses get pass, in the order a receiver checks them. Each address has its own count: one that an include's record decides early goes on with only the lookups it used, so a limit only affects the addresses that reach it.
"Would this server be allowed?" fetches the same tree in the same few batches, then runs check_host() (§4) on your device for the address you give, the way a receiver does: term by term, stopping at the first match. Reverse DNS for ptr and %{p}, names built from macros (§7) and the exp= explanation are looked up only if the check reaches them.
"A record you paste" works offline. Nothing is sent, so the request log stays empty.

What's kept: nothing. What you type is copied into this page's address so you can share the result, but it isn't stored. The resolver sees the queries arrive from Cloudflare's network, not from your IP address.

Limitations:

DNS is seen through Cloudflare's resolver, so a change can take up to the record's TTL to show here.
Terms built from the sender (macros and ptr) can only be tested with "Would this server be allowed?".
This page reads records of up to 8,192 characters and 200 terms. That's its own limit, not SPF's: receivers evaluate longer records, and so does "Would this server be allowed?".
To be fair to the resolver, a check stops after 60 records or 200 DNS questions. Receivers give up at 10 lookups, long before that. abbott.cloud also limits how many lookups each visitor can make a minute.

Code: spf.js (this page), lib/spf.js (RFC 7208 parsing, evaluation and check_host), spfreport.js (explanations and summaries), txtpaste.js (reading pasted records), ip.js (address maths), net.js (requests).