SPF.Guru Sign in

SPF checker

Evaluate a domain's SPF record the way a receiving mail server does. Every mechanism, DNS lookup and macro expansion is shown, so you can see not just the verdict but where it came from.

A bare domain works too

IPv4 or IPv6

Defaults to the sender domain

Evaluated instead of the published record, so you can test one before publishing it. Includes inside it still resolve live.

softfail

The sending IP is not authorised, but the domain asks for a soft landing.

DNS terms used
2 of 10
Void lookups
0 of 2
DNS queries
3
Elapsed
28 ms

How it was evaluated

  1. record for spf.messagelabs.com v=spf1 include:nets1.spf.messagelabs.com include:nets2.spf.messagelabs.com ~all
  2. include:nets1.spf.messagelabs.com no match
    • nets1.spf.messagelabs.com returned neutral
  3. record for nets1.spf.messagelabs.com v=spf1 ip4:85.158.136.0/21 ip4:193.109.254.0/23 ip4:194.106.220.0/23 ip4:195.245.230.0/23 ip4:95.131.104.0/21 ip4:46.226.48.0/21
  4. ip4:85.158.136.0/21 no match
  5. ip4:193.109.254.0/23 no match
  6. ip4:194.106.220.0/23 no match
  7. ip4:195.245.230.0/23 no match
  8. ip4:95.131.104.0/21 no match
  9. ip4:46.226.48.0/21 no match
  10. include:nets2.spf.messagelabs.com no match
    • nets2.spf.messagelabs.com returned neutral
  11. record for nets2.spf.messagelabs.com v=spf1 ip4:216.82.240.0/20 ip4:67.219.240.0/20 ip4:117.120.16.0/21 ip4:103.9.96.0/22 ip4:35.228.216.85 ip4:146.148.116.76 ip4:34.141.160.224 ip4:34.70.158.162 ip4:34.74.74.140 ip4:34.83.159.189
  12. ip4:216.82.240.0/20 no match
  13. ip4:67.219.240.0/20 no match
  14. ip4:117.120.16.0/21 no match
  15. ip4:103.9.96.0/22 no match
  16. ip4:35.228.216.85 no match
  17. ip4:146.148.116.76 no match
  18. ip4:34.141.160.224 no match
  19. ip4:34.70.158.162 no match
  20. ip4:34.74.74.140 no match
  21. ip4:34.83.159.189 no match
  22. ~all softfail

DNS queries

NameTypeResultSourceTime
spf.messagelabs.com TXT NOERROR dns 9.7 ms
nets1.spf.messagelabs.com TXT NOERROR dns 9.3 ms
nets2.spf.messagelabs.com TXT NOERROR dns 8.2 ms

Answers marked shared cache came from a recent check by someone else and cost no network round trip; cache means the same name was needed twice within this one evaluation. Entries expire after a minute, so if you have just changed a record, allow that long before the change shows here.