# SPF Guru

> Free tool that measures what an SPF record costs in DNS lookups, explains why it exceeds the RFC 7208 limit of ten, and generates a replacement record a receiving server resolves in one lookup. No account, no payment, nothing to install.

Every number comes from spftrace, an RFC 7208 evaluator, run against live DNS at the moment of the request.

## API

- [Analyse a domain](https://spf.guru/api/analyse?domain=example.com): what its record costs and the replacement that costs one lookup
- [Expand the include tree](https://spf.guru/api/tree?domain=example.com): every nested include and what each branch costs
- [Evaluate a message](https://spf.guru/api/check?sender=user@example.com&ip=192.0.2.1): the result a receiving server would reach, with every step
- [OpenAPI description](https://spf.guru/openapi.json)
- [API documentation](https://spf.guru/api)

Rate limited to 10/minute per address.

## Pages

- [SPF Guru](https://spf.guru/): Free tool that rewrites an over-limit SPF record so receiving mail servers only ever perform one DNS lookup. Fixes the SPF PermError caused by too many DNS lookups.
- [SPF checker](https://spf.guru/check): Test an SPF record the way a receiving mail server does. Enter a sender and a sending IP address and see the result plus every mechanism, DNS lookup and macro expansion along the way.
- [Include tree](https://spf.guru/tree): Expand a domain's SPF record, including every nested include, and see what each branch costs. Find which vendor is consuming your ten DNS lookups.
- [How it works](https://spf.guru/how-spf-guru-works): A technical explanation of how SPF Guru uses a macro-based include to compress an SPF record down to one DNS lookup while staying RFC 7208 compliant.
- [Fix SPF PermError](https://spf.guru/spf-permerror-fix): What SPF PermError means, why the 10 DNS lookup limit causes it, and how to fix it without flattening your record into a stale list of IP addresses.
- [Fix vendor records](https://spf.guru/freshdesk-mailgun-google-spf-too-big): Mailgun, Freshdesk and similar vendors publish SPF records that consume several DNS lookups on their own. Here is how to keep them without breaking your record.
- [FAQ](https://spf.guru/faq): Answers to common questions about SPF records, the 10 DNS lookup limit, PermError, DMARC alignment and how SPF Guru fits in.
- [The library](https://spf.guru/spftrace-python-spf-library): spftrace is an open-source RFC 7208 SPF evaluator for Python that returns the full evaluation trace: every DNS lookup, macro expansion and mechanism. It is the library behind SPF Guru.
- [About](https://spf.guru/about-spf-guru): Why a free, cloud-hosted SPF macro service exists, how it grew out of the Expurgate open-source project, and who pays for it.
- [API](https://spf.guru/api): A free JSON API returning what an SPF record costs in DNS lookups, its expanded include tree, and the result a receiving server would reach. No account or key needed.
- [Security](https://spf.guru/security): How to report a vulnerability in SPF Guru, what is in scope, and what to expect. A free, best-effort service run by one person, so no bug bounty is offered.
- [Disclaimer](https://spf.guru/disclaimer): SPF Guru is a free, best-effort service provided without warranty. Read this before relying on it for production mail.

## Vendor lookup costs

- [All vendors measured](https://spf.guru/spf/vendors)
- [Mimecast](https://spf.guru/spf/mimecast): 9 DNS lookups for include:_netblocks.mimecast.com
- [Freshdesk](https://spf.guru/spf/freshdesk): 7 DNS lookups for include:email.freshdesk.com
- [Mailgun](https://spf.guru/spf/mailgun): 5 DNS lookups for include:mailgun.org
- [Zoho](https://spf.guru/spf/zoho): 5 DNS lookups for include:zoho.com
- [Oracle NetSuite](https://spf.guru/spf/netsuite): 5 DNS lookups for include:sent-via.netsuite.com
- [Google Workspace](https://spf.guru/spf/google-workspace): 1 DNS lookup for include:_spf.google.com
- [Microsoft 365](https://spf.guru/spf/microsoft-365): 1 DNS lookup for include:spf.protection.outlook.com
- [SendGrid](https://spf.guru/spf/sendgrid): 2 DNS lookups for include:sendgrid.net