What this does
Parses an SPF TXT record — v=spf1 include:_spf.google.com ~all — entirely in your browser and breaks it down into its mechanisms, qualifiers, includes, and modifiers, counts how many of SPF's limited 10 DNS lookups the record directly uses, and flags the mistakes that most commonly break SPF in production: missing or misplaced all, +all, duplicate SPF records, the deprecated ptr mechanism, and more.
Why the lookup count has a caveat
This tool never performs a real DNS query — it's a pure text parser, matching the "browser-only" way every tool on this site works. That means the lookup count shown is accurate for this record, but a domain's include mechanisms each pull in another domain's own SPF record, which may itself use several more lookups. The true total across the whole chain can only be found by actually resolving every include recursively — something worth checking with a DNS query tool once this record itself looks correct.
What counts toward the 10-lookup limit
Per RFC 7208, include, a, mx, ptr, exists, and the redirect modifier each cost one DNS lookup. ip4, ip6, and all cost nothing — they don't require a DNS query to evaluate. Exceeding 10 total lookups is a hard failure (PermError) under the RFC, not a soft warning — receivers are required to fail the record entirely once the limit is crossed.
FAQ
What does the qualifier before a mechanism mean?
It's the result SPF returns when that mechanism matches: + is Pass (the default when no qualifier is written), - is Fail, ~ is SoftFail (treated as a suspicious-but-not-rejected signal by most receivers), and ? is Neutral (treated the same as no policy at all).
Why does this only count 1 lookup per include, even though the included domain might do more lookups itself?
Because this tool only ever sees the text of the one record you pasted — it can't perform real DNS resolution to follow an include into another domain's own SPF record. The lookup count shown is accurate for this record alone; the true total also includes every DNS-querying term inside each included domain's own SPF record, recursively.
What actually happens if my SPF record exceeds 10 lookups?
RFC 7208 requires receivers to stop evaluating and return a PermError once the 10-lookup limit is exceeded — not to just ignore the extra terms. A PermError generally means SPF fails entirely for that domain, so a message from a genuinely authorized server can fail SPF right alongside a forged one.
Should I use ~all or -all?
-all (Fail) tells receivers a message that doesn't match any earlier mechanism should be rejected outright — the stricter, generally recommended setting once you're confident every legitimate sending source is already listed. ~all (SoftFail) asks receivers to treat unmatched mail with suspicion without hard-rejecting it — a safer choice while you're still verifying a new or changed record.
Can a domain have more than one SPF TXT record?
No — RFC 7208 requires exactly one. Having more than one (a common mistake when adding a new provider without removing the old record) causes a PermError and fails SPF entirely, which this tool specifically checks for.
Does this tool query DNS or send my record anywhere?
No — it only parses the text you paste, entirely in your browser. It never performs a DNS lookup itself, which is also why it can't verify what an include actually resolves to.
Try it yourself
For the full picture of how SPF actually works — not just what this parser flags — see SPF Records Explained.