SPF Check

What It Does

Retrieves SPF TXT records from DNS, validates only one SPF record exists (multiple records cause PermError), parses the SPF syntax tree, expands include/redirect mechanisms, counts DNS lookup mechanisms (max 10 per RFC 7208), identifies authorized sending IPs and domains, and evaluates the default policy qualifier (+all, ~all, -all, ?all). Returns a security score (0-100), letter grade, and specific recommendations. Detects issues like exceeding the 10-lookup limit (which causes PermError), redirect/all coexistence (RFC 7208 §6.1), invalid include domain syntax, using deprecated ptr mechanism (slow and unreliable), invalid and overly broad ip4/ip6 CIDR ranges, and SPF macro syntax (advanced feature per RFC 7208 §7).

Why It's Useful

SPF is the foundation of email authentication (RFC 7208) and is required for proper DMARC enforcement. Misconfigured SPF records are the #1 cause of email deliverability issues — exceeding the 10 DNS lookup limit silently causes PermError, and overly permissive policies (+all, ?all) leave domains vulnerable to spoofing. Google, Yahoo, and Microsoft now require valid SPF for bulk senders (5,000+ emails/day) as of 2024-2025, with non-compliant emails facing rejection.

Use Cases

Parameters

Response Fields

Code Examples

curl "https://api.edgedns.dev/v1/security/spf" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "domain=google.com"

const response = await fetch(
  'https://api.edgedns.dev/v1/security/spf?domain=google.com',
  {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY'
    }
  }
);

const data = await response.json();
console.log(data);

import requests

response = requests.get(
    'https://api.edgedns.dev/v1/security/spf',
    headers={'Authorization': 'Bearer YOUR_API_KEY'},
    params={
    'domain': 'google.com'
    }
)

data = response.json()
print(data)

Related Endpoints

External References

Learn more about the standards and protocols behind this endpoint.