🔧

SPF Validator & Flattener

Deep analysis of SPF limits, resolving nested includes, and detecting the dreaded "10 lookup limit" violation.

CONSTRAINT: Max 10 DNS Lookups
MECHANISMS: a, mx, ptr, include, exists
OUTCOME: PermError

What is SPF Validator & Flattener?

A specialized tool to unpack complex SPF records. It recursively follows every `include:` statement to count the total number of DNS lookups required to resolve the full list of authorized IPs.

How it Works

The validator simulates an email receiver's SPF daemon. It builds a hierarchical tree of your SPF record. If the total number of mechanisms requiring a DNS lookup (like `include` or `a`) exceeds 10, the record explicitly fails with a PermError.

Key Use Cases

Fixing "SPF PermError: too many DNS lookups" rejection bounces.

Consolidating old vendors and slimming down enterprise DNS configurations.

Flattening an SPF record into purely IP4/IP6 blocks to eliminate lookup overhead.

Advanced Details

Mechanisms like `ip4` and `ip6` do NOT count toward the 10-lookup limit because they are parsed locally. Only mechanisms that invoke an external DNS request count.

Cybersecurity Pros & Cons

Security Advantages
  • Proactively detects lookup limit violations before they silently break authentication and allow spoofing.
  • Flattened SPF records (IP4/IP6 only) are faster to evaluate and immune to third-party DNS availability issues.
  • Hierarchical include tree visualisation reveals which third-party providers are in your SPF trust chain.
  • Identifies stale or decommissioned `include:` entries that expand the authorised sender list unnecessarily.
Security Limitations
  • Flattened SPF records require manual updates each time an included provider changes their IP ranges — high maintenance burden.
  • Over-flattening can create excessively long SPF records that exceed the 512-byte UDP DNS response limit.
  • The validator only catches syntactic and lookup count issues — logical errors (wrong IPs, missing providers) require manual audit.
  • Third-party `include:` services can silently modify their underlying IP ranges, expanding your authorised senders without notice.
Ready to Test?

Use our professional-grade tool to perform a real-time check for this module.

Run Module Now
Related Docs