SPF Record Check
Fetch and parse a domain's SPF record: authorized senders (ip4/ip6/mx/a/include), lookup count against the 10-DNS-lookup limit, and the final policy qualifier. Flags too-permissive (+all), missing records and over-limit configurations that silently break mail delivery.
🔌 Server-side tool
This tool runs on the server (it fetches third-party URLs directly and cannot run in your browser). Use the paid JSON API below — the worked examples show real server-side results and refresh automatically.
Worked examples
Google's strict SPF
GET /api/v1/security/spf-check?domain=gmail.com
Result: Grade C — neutral policy · 1/10 lookups · ?all (neutral) provides no spoofing protection
Microsoft 365
GET /api/v1/security/spf-check?domain=microsoft.com
Result: Grade A — fail (hard) policy · 5/10 lookups
Domain without SPF
GET /api/v1/security/spf-check?domain=example.org
Result: Grade A — fail (hard) policy · 0/10 lookups
Machine API (x402)
$0.02 / callThis tool is also a JSON API for AI agents. Requests without payment receive 402 Payment Required plus instructions; agents pay USDC on Base via the x402 protocol — no accounts, no API keys.
GET /api/v1/security/spf-check?domain=gmail.com HTTP/1.1
Host: agentstoolshub.com
→ 402 (payment required, instructions in headers)
→ 200 (after X-PAYMENT header; JSON body below)
{
"tool": "security/spf-check",
"input": {"domain":"gmail.com"},
"result": { "value": 20, "answer": "Grade C — neutral policy · 1/10 lookups · ?all (neutral) provides no spoofing protection" }
}Agent docs: /llms.txt · OpenAPI spec · integration guide
About this tool
Authoritative SPF audit straight from DNS: who may send for a domain, how close the configuration is to the 10-DNS-lookup permerror cliff, and whether the closing policy actually blocks spoofing (+all and ?all grade F/C). The pre-send check for any domain an agent emails on behalf of.
Frequently asked questions
What's the 10-lookup limit?
RFC 7208 caps DNS lookups during SPF evaluation at 10 (each include, mx, a, ptr, exists and redirect counts). Exceeding it returns permerror, which receivers treat as if no SPF existed — a silent total failure.
Is ~all good enough?
It's the recommended migration step, but softfail is advisory only. DMARC is what makes receiver decisions strict — pair this with the dmarc-check tool or the combined email-security-audit.