All free toolsFree tool · Email security
Does your SPF record break the 10-lookup limit?
Walk your full SPF chain, count the real DNS lookups and catch the mistakes that make receiving servers reject your mail.
- SPF Lookup Validator
- Output: Console
- Free, no trial or account needed
Check your inbox
The link is on its way
We sent the download link to . It works for 7 days. Can’t find it? Check your junk folder.
While you wait: see Griffin31What it finds
- The real lookup count across every nested include
- Risky settings such as +all and ?all, and the deprecated ptr mechanism
- The full include tree
- Syntax and length problems
Why it matters
SPF allows at most 10 DNS lookups. Nested includes add up quietly as you add services, and going over the limit makes SPF fail for all your mail.
How it works
- 01Get the toolLeave your details and we email you the download link.
- 02Run itRun ./spf.sh and enter your domain, or paste an SPF record.
- 03Read the resultThe lookup count, the include tree, and any errors or warnings.
- 04Fix what mattersRemove or flatten includes until you’re under 10 lookups.
Requirements
- Bash on macOS or Linux
- dig (built in on macOS)
What it can touch
Reads public DNS records only. It needs no sign-in and touches nothing in your tenant.
Griffin31
This tool checks one area. Griffin31 checks your whole tenant.
More than 370 Microsoft 365 security settings, the evidence behind every result, what to fix first, and an email when a setting slips back.
More free tools
Conditional AccessConditional Access Policy AnalyzerScore your Conditional Access policies and find the gaps attackers use.IdentityEntra App Registration AuditFind risky app permissions, expiring credentials and unused apps.Data and collaborationSharePoint Sites AuditFind the sites, OneDrives and Teams shared too widely.