SPF checker
Follows every include and redirect the way a receiving mail server does, so the lookup count is the real one, not just the top level.
Public data, possible errors. Every result here is built only from publicly available information: DNS records, and what a server shows to anyone who connects. It can be incomplete or wrong. DNS caching, a record changed minutes ago, split-horizon DNS, or a provider that signs and routes mail on your behalf can all make the public view differ from your real configuration. Treat a result as a starting point, not a verdict, and always have an administrator with the appropriate privileged access confirm it on the systems themselves before changing anything.
What SPF does
SPF (Sender Policy Framework) is a TXT record at your domain that lists the servers allowed to send its mail. A receiving server checks the connecting server's address against that list, and the all at the end tells it what to do with everyone else.
SPF checks the envelope sender, not the From: address people see, so on its own it doesn't stop someone forging your domain in the From: line. That's DMARC's job, and DMARC can use a passing SPF result as one of its two signals.
The trap most domains fall into is the 10-lookup limit. Every include, a, mx, ptr, exists and redirect costs a DNS lookup, and so does everything inside the includes. Above ten, most receivers return a permanent error for every server listed past that point, and some fail the whole record, so legitimate mail can fail SPF too.
Records fixed? Now test the people.
SPF, DKIM and DMARC stop someone forging your domain. They don't stop a lookalike domain, or a colleague typing their password into one. Phishtime runs authorised phishing simulations against your own team, free for up to 25 employees.