Is your domain's email actually authenticated?

Most checkers tell you whether an SPF record exists. That is the easy half. This one expands your entire SPF tree, counts DNS lookups against the RFC 7208 limit, and tells you whether the record still works when a receiver evaluates it.

Runs entirely in your browser using DNS-over-HTTPS. Nothing is sent to us, and nothing is stored. Every result can be reproduced with dig.

We scanned the top 10,000 domains. 163 of them have SPF records that exceed the RFC limit and cannot be evaluated. 104 of those enforce a DMARC policy anyway. Read the findings →

What this checks that most tools don't

The 10-lookup limit

RFC 7208 permits an SPF record a maximum of ten DNS-querying mechanisms across the entire chain of nested includes. Exceed it and evaluation returns PERMERROR — SPF does not fail open, it fails. A tool that only checks whether a record exists will call such a domain healthy. Counting the real total means recursively expanding every include, which is why it is usually skipped.

Records longer than 255 bytes

DNS transmits long TXT records in 255-byte segments that must be rejoined with no separator. Parsers that read only the first segment silently truncate the record — and they do it precisely on the large, many-sender domains where the answer matters most.

Macro-based includes

Gateways such as Proofpoint publish includes like %{ir}.%{v}.%{d}.spf.has.pphosted.com, which expand at delivery time from the sending IP. They cannot be resolved statically. Naive scanners report them as broken; in our own scan of the top 10,000 domains, roughly one in sixteen uses this syntax and would be misreported.

Get it fixed properly

$99 one-time, per domain

The check above tells you what is wrong. This fixes it — with records you can paste in, and a rollout order that will not break your existing mail.

Full audit — deep DKIM selector probe across 29 known provider selectors, not the six a quick scan covers.
Sender inventory — every third-party service currently authorised to send as your domain, identified by name.
Exact DNS records — copy-paste ready, with the specific host and value fields for your DNS provider.
SPF lookup remediation — if you are at or over the limit, a concrete restructuring plan rather than "remove some includes".
A safe DMARC rollout schedule — the staged path from p=none to enforcement, with what to watch at each step. Going straight to p=reject is how people lose real mail.
Verification re-scan — after you publish the changes, we confirm they evaluate correctly.
14 days of follow-up questions by email.

Order a fix pack

Delivered within one business day. No calls, no scheduling. If the audit finds nothing worth fixing, we refund it — that outcome is rare, but it happens, and charging for it would be dishonest.

Method

Checks run client-side against Cloudflare and Google DNS-over-HTTPS resolvers. SPF trees are expanded recursively with a shared lookup budget, matching how a receiving mail server evaluates them. Macro-containing targets are counted as one lookup and not expanded, so totals for those domains are reported as a lower bound rather than an exact figure. A lookup that fails to resolve is reported as undetermined — never as a fault, because a transient resolver failure is not a misconfiguration.