Moletools

SPF Deep Analyzer

Enter a domain to expand its complete SPF dependency tree and find the exact terms that can cause permerror or authorization risk.

This tool queries public DNS only. Results are cached for up to 10 minutes. It does not send email or probe recipients.

Frequently asked questions

Why is SPF limited to 10 DNS lookups?
RFC 7208 limits DNS-querying terms to protect receivers from expensive or abusive policies. Exceeding the limit can cause a permanent SPF error.
Why is the lookup count different from the number of include terms?
Each include can contain more include, a, mx, ptr, exists, or redirect terms. The analyzer recursively counts the complete worst-case path, not just the root text.
Can this tool prove whether a specific IP passes SPF?
Not in this version. It audits policy structure without a sender IP, HELO name, or MAIL FROM address. Macro-dependent and message-specific evaluation needs those inputs.