SPF Check
The SPF check resolves the SPF record including all includes, counts DNS lookups against the limit of 10 and lists every authorized IP range.
SPF (Sender Policy Framework) defines which servers may send mail on behalf of your domain. The record is a TXT record directly on the domain and starts with v=spf1. The SPF-Check in the Mail category reads this record, resolves all include and redirect references recursively and checks it against RFC 7208. It requires a license.
How to check
Enter the domain, for example example.com, and click Prüfen (check). The app shows three tables:
| Table | Content |
|---|---|
| SPF-Record | the record found, or all of them if there are several |
| SPF-Baum (SPF tree) | every term with qualifier, lookup number and note, indented by include depth |
| IP-Bereiche (IP ranges) | all ip4 and ip6 ranges with qualifier and the domain they come from |
In the SPF-Baum, the Lookup column shows which term uses which of the ten allowed DNS lookups. That makes it easy to see which provider costs the most lookups.
The lookup limit
Receivers may make at most 10 DNS lookups while evaluating SPF. Every include, a, mx, ptr, exists and redirect counts, including those inside includes. Above the limit, the whole record is invalid (PermError) and SPF fails for every message.
| Lookups | Finding |
|---|---|
| up to 7 | OK |
| 8 to 10 | Warning: close to the limit; one more include at a provider can break the record |
| over 10 | Error: limit exceeded |
To fix it: remove includes for services you no longer use, replace ptr, a and mx with fixed ip4/ip6 ranges, or use SPF flattening.
The app also counts void lookups: terms whose target doesn’t exist or returns nothing. More than two of them is an error too.
The “all” at the end
The qualifier in front of all decides what happens to mail from all other servers:
| Term | Finding | Meaning |
|---|---|---|
-all |
OK | other servers are rejected |
~all |
OK | other servers are marked SoftFail; common together with DMARC p=reject |
?all |
Warning | doesn’t protect |
+all |
Error | allows any server to send on behalf of the domain |
| missing | Warning | without all, other servers get “Neutral” |
If the all only appears in a record included via redirect, the app evaluates that one.
Other findings
| Finding (as shown in the app) | What to do |
|---|---|
| Kein SPF-Record | No SPF record. Create one. If the domain sends no mail, v=spf1 -all is enough. |
| 2 SPF-Records (or more) | Multiple v=spf1 records cause a PermError. Merge them into one. |
| Syntaxfehler | Syntax error: an unknown mechanism, an invalid IP or prefix length. Receivers treat the record as PermError. |
| Langer Record | Long record: over 450 characters the DNS response can be truncated over UDP. Combine includes or ranges. |
| Schleife | Loop: an include points to a record higher up in the chain. |
| include „…“: kein SPF-Record | An included service has no SPF record (any more). Remove or fix the include. |
| „ptr“ ist veraltet | ptr is deprecated by RFC 7208. Replace it with ip4/ip6. |
| … steht nach „all“ | Terms after all are never evaluated. |
| Makros werden nicht aufgelöst | Macros like %{i} depend on the sender; the app only displays them. |
Resolution stops after 60 queries so a broken record can’t keep the app busy forever. A note tells you when that happens.
Working with DMARC
SPF alone only protects the technical sender (envelope from). What receivers do with mail that fails SPF and DKIM is up to DMARC. For the big picture, use the mail domain report.