SPF Record Checker

Validate any domain's SPF record and catch the failure everyone misses: the 10-DNS-lookup limit. Check one domain or up to 200 per run, online, by API, or as an agent tool via Apify MCP.

This actor fetches the v=spf1 TXT record, parses every mechanism, counts DNS lookups against RFC 7208's hard limit of 10 (exceed it and receivers return PermError — your SPF silently stops working), and flags permissive or missing all qualifiers. Useful for deliverability audits, cold-email domain setup, security reviews, and lead generation (find domains with broken SPF).

What you get

• hasSpf — is a v=spf1 record published?
• record — the raw SPF string
• mechanisms — every term parsed: qualifier (+/-/~/?), type (ip4, include, mx, …), value, and whether it costs a DNS lookup
• lookupCount — total DNS lookups vs the RFC 7208 limit of 10
• allQualifier — how unmatched senders are treated (-all fail, ~all softfail, ?all neutral, +all open)
• issues — plain-English flags: no record, multiple records (an RFC error), over the lookup limit, +all/?all, missing all
• Fail-soft: an invalid domain or a DNS error never fails the run — it returns {ok: false, error} and is never charged.

Input

{ "domains": ["github.com", "microsoft.com"], "maxDomains": 50 }

Or a single domain: { "domain": "google.com" }

Output (real run)

{
  "domain": "github.com",
  "ok": true,
  "hasSpf": true,
  "record": "v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com ... ~all",
  "mechanisms": [
    { "qualifier": "+", "type": "ip4", "value": "192.30.252.0/22", "lookup": false },
    { "qualifier": "+", "type": "include", "value": "spf.protection.outlook.com", "lookup": true }
  ],
  "lookupCount": 8,
  "allQualifier": "~",
  "issues": []
}

Pricing

$0.0008 per domain checked. No start fee. Invalid domains and DNS failures are never charged.

Measured against store incumbents (2026-08-07): andok/dmarc-spf-dkim-validator charges $0.001 per item, blackfalcondata/email-deliverability-checker $0.00005 start + $0.001 per item, davidbenittah/dmarc-rfc9989-auditor $0.005 start + $0.005 per item. A 100-domain sweep here costs $0.08.

Honest limits

• Lookup counting is static: it counts lookup-type mechanisms in the top-level record (include, a, mx, ptr, exists, redirect). It does not recursively resolve nested includes, so a record that nests its way over the limit can pass here — the top-level count is what most audits need first.
• DNS-only: no test emails are sent; this validates the published record, not your mail server's behavior.
• One record per domain: when multiple SPF records exist (an RFC violation, flagged in issues), the first is parsed.

FAQ

Why does the 10-lookup limit matter? RFC 7208 caps SPF evaluation at 10 DNS lookups. Past that, receivers return PermError and your SPF effectively fails — a very common silent misconfiguration after adding several SaaS senders.

What's the difference between ~all and -all? -all tells receivers to fail unmatched senders outright; ~all marks them suspicious (softfail). ?all and especially +all provide no real protection and are flagged.

Does it check DKIM or DMARC too? No — this is a focused SPF tool. Pair it with our DMARC Record Checker and MX Record Checker for the full email-auth picture.

Can I paste full URLs? Yes. https://www.example.com/path is cleaned to example.com automatically; duplicates are removed.

Why did some rows come back ok: false? Those inputs were not valid domains or their DNS lookup failed transiently. They are recorded for completeness and never charged.

Use from code or AI agents

curl -s "https://api.apify.com/v2/acts/EliAI~spf-record-checker/run-sync-get-dataset-items?token=$APIFY_TOKEN" \
  -X POST -H 'Content-Type: application/json' \
  -d '{"domains": ["yourdomain.com", "competitor.com"]}'

Agents: connect Apify MCP and call the EliAI/spf-record-checker tool.

• Capability: fetch, parse and lint the SPF record of one or many domains, returned as JSON
• Required input: domain (string) or domains (array)
• Returns: one JSON record per domain; lookupCount + issues summarize the verdict
• Bounded: maxDomains caps the run; failures isolate per domain
• Side effects: none