WTFSPF?

WTF is wrong with my SPF?

A free SPF checker and SPF record lookup that follows every include, counts every DNS lookup, and explains what's broken in plain English.

Free. No account required. No email address required.
01
Follow every include
We resolve the entire SPF dependency tree, not just the TXT record on your apex domain. Every nested include, every redirect, every authorized IP range.
example.com
├─ _spf.example.net
│  └─ _netblocks.example.net
└─ example.org
02
Find the actual problem
Lookup-limit overruns, include loops, invalid mechanisms, duplicate SPF records, risky +all policies, and complexity you don't need.
lookup limitinclude loopduplicate SPF+all
03
Explain it like a human
You get an SPF diagnosis and a fix, not a wall of TXT records. Send the report link to a coworker and they'll understand it too.
"Uses 8 of 10 lookups. Room for about one more typical SaaS sender. Nothing to fix today."
Example diagnostic
What the SPF checker reports
example.comWTF LEVEL: HIGH
11
11 DNS lookups
SPF permits a maximum of 10 DNS-triggering mechanisms during evaluation.
LOOKUP BUDGET11 / 10
■ Email Suite: 3■ Marketing Platform: 4■ Email Delivery: 3■ Legacy Mail Relay: 1 over
example.com
├── _spf.example.net Email Suite3
├── …mkt.example.org Marketing Platform4
├── send.example.net Email Delivery3
└── relay.example.org Legacy1 ⚠
There's your WTF.
Your record is syntactically valid, but some receiving servers may return an SPF PermError because resolving it can exceed the DNS lookup limit.
Suggested action
Consolidate or remove:
include:send.example.net
include:relay.example.org
SPF record checks

Built for the SPF failures that break real email.

WTFSPF checks the published v=spf1 TXT record, recursively resolves SPF includes and redirects, and shows whether the record can exceed the SPF 10 DNS lookup limit.

SPF lookup count and 10-lookup limit warnings
Nested include and redirect tree inspection
Duplicate SPF records and TXT syntax errors
Softfail, hardfail, neutral, and +all policy review
Useful next steps

Keep an eye on the rest of your mail setup.

MyDMARC

See who is actually sending mail as your domain, catch spoofing, and move DMARC from monitoring to enforcement.

Analyze DMARC reports with MyDMARC →
OneDollarDNS

Get alerted when SPF, DMARC, MX, or other DNS records change before a vendor surprise becomes a mail problem.

Monitor DNS with OneDollarDNS →