SPF Inspector
Lookup, parse, and analyze SPF records with DNS lookup counting and evaluation tree.
DNS lookups and policy retrieval run from the PacketWizard server with SSRF protections and timeout handling.
What is SPF Inspector?
An SPF checker looks up and evaluates a domain’s Sender Policy Framework TXT record so you can see which hosts are authorized to send mail and whether DNS lookup limits are at risk.
How it works
Enter a domain. PacketWizard fetches the SPF record, parses mechanisms and modifiers, counts DNS lookups, and highlights common policy mistakes.
Common issues
Too many DNS lookups
SPF allows a maximum of 10 DNS-causing mechanisms (include, a, mx, etc.). Flatten or redesign includes when you approach the limit.
Multiple SPF TXT records
Domains should publish a single SPF record. Multiple SPF TXT records cause unpredictable authentication failures.
Frequently asked questions
What does a softfail (~all) mean?
~all tells receivers the sender is probably unauthorized but should not hard-fail. Many domains start with ~all while monitoring DMARC before moving to -all.
Does SPF alone stop spoofing?
No. Pair SPF with DKIM and a DMARC policy so receivers know how to treat failed authentication.
Related tools
Continue with these related PacketWizard tools for adjacent diagnostics.