LeaderboardEvery site, rankedFree toolsChecks, no sign-upAgentsYour agent fixes itDocsThe API and MCP

SPF record checker

Validate a domain’s SPF record: each term and qualifier, every include followed as a tree, DNS lookups counted against the limit of 10 and empty ones against 2.

More checksPagesUtilities

The answer for allbirds.com

allbirds.comSPF is sound: 5 of 10 lookups

The SPF record of allbirds.comv=spf1 include:allbirds_com._es.easydmarc.com include:spf.protection.outlook.com ~all

5of 10 DNS lookups

  • Good5 of 10 DNS lookupsInside the limit receivers allow, counting every include, a, mx, ptr, exists and redirect followed.
  • GoodEnds in ~allMail from servers not listed soft fails, and with DMARC it is held to its policy.

Each term

  • Passinclude:allbirds_com._es.easydmarc.comWhatever allbirds_com._es.easydmarc.com’s own record allows
  • Passinclude:spf.protection.outlook.comWhatever spf.protection.outlook.com’s own record allows
  • Soft fail~allEvery other server

Every record followed

  1. allbirds.com5 lookups in all
    1. include:allbirds_com._es.easydmarc.com3 lookups insidev=spf1 include:_spf.allbirds_com._d.easydmarc.pro ~all
      1. include:_spf.allbirds_com._d.easydmarc.pro2 lookups insidev=spf1 mx:allbirds.com ip4:74.125.0.0/16 ip4:209.85.128.0/17 ip6:2001:4860:4864::/56 ip6:2404:6800:4864::/56 ip6:2607:f8b0:4864::/56 ip6:2800:3f0:4864::/56 ip6:2a00:1450:4864::/56 ip6:2c0f:fb50:4864::/56 ip4:199.255.192.0/22 ip4:199.127.232.0/22 ip4:54.240.0.0/18 ip4:69.169.224.0/20 ip4:23.249.208.0/20 ip4:23.251.224.0/19 ip4:76.223.176.0/20 ip4:54.240.64.0/18 ip4:76.223.128.0/19 ip4:216.221.160.0/19 ip4:206.55.144.0/20 ip4:24.110.64.0/18 ip4:98.77.0.0/16 ip4:103.151.192.0/23 ip4:185.12.80.0/22 ip4:188.172.128.0/20 ip4:192.161.144.0/20 ip4:216.198.0.0/18 ip4:167.89.0.0/17 ip4:208.117.48.0/20 ip4:50.31.32.0/19 ip4:198.37.144.0/20 ip4:198.21.0.0/21 ip4:192.254.112.0/20 ip4:168.245.0.0/17 ip4:149.72.0.0/16 ip4:159.183.0.0/16 ip4:134.128.64.0/18 ip4:159.26.176.0/20 ip4:223.165.113.0/24 ip4:223.165.115.0/24 ip4:223.165.118.0/23 include:_spf1.allbirds_com._d.easydmarc.pro -all
        1. include:_spf1.allbirds_com._d.easydmarc.proNo lookups insidev=spf1 ip4:223.165.120.0/23 ip4:3.7.25.40/29 ip4:13.127.153.86 ip4:52.66.154.99 ip4:13.127.210.61 ip4:3.120.181.200/29 ip4:35.159.219.224/28 ip4:18.199.180.160/27 ip4:3.222.0.24/29 ip4:198.21.4.52 ip4:167.89.31.27 ip4:167.89.127.244 ip4:44.192.35.0/24 ip4:3.25.47.0/29 ip4:141.193.32.0/23 ip4:159.135.140.80/29 ip4:159.135.132.128/25 ip4:161.38.204.0/22 ip4:87.253.232.0/21 ip4:185.189.236.0/22 ip4:185.211.120.0/22 ip4:185.250.236.0/22 ip4:143.55.236.0/22 ip4:198.244.60.0/22 ip4:204.220.160.0/20 ip4:159.135.224.0/20 ip4:69.72.32.0/20 ip4:204.220.90.0/23 ip4:204.220.92.0/22 ip4:161.38.192.0/20 ip4:143.55.224.0/21 ip4:143.55.232.0/22 ip4:159.112.240.0/20 ip4:198.244.48.0/20 ip4:204.220.168.0/21 ip4:204.220.176.0/20 -all
    2. include:spf.protection.outlook.comNo lookups insidev=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all

Lookups counted as receivers count them: each include, a, mx, ptr, exists and redirect, through every include, against the limit of 10 in RFC 7208. Asked of public resolvers (1.1.1.1 and 8.8.8.8) as anyone on the internet sees it, at the moment of the check. A record changed in the last few hours may not show everywhere yet.

One part of allbirds.com’s DNS.The DNS health check reads its name servers, SOA, addresses, CAA and every mail record at once.
Check all of its DNS
A record well inside the limitExample
v=spf1
Version
include:_spf.mail.example
3 lookups, 2 inside it
include:send.example.net
1 lookup
mx
1 lookup
a
1 lookup
ip4:203.0.113.0/24
No lookup
~all
The rest is suspect

6of 10 lookups

  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10

Each include, a, mx, exists and redirect costs a lookup, and so does every one inside an include. ip4, ip6 and all cost none. Past ten, SPF fails for every message.

What does it check?

No rule in the rulebook covers this, so here is what it reads.

  1. The SPF record, and whether there is exactly one
  2. Every include, followed
  3. How many DNS lookups it takes, against the limit of ten
  4. Whether it ends in ~all or -all

Questions

What is the SPF lookup limit?

Ten. Each include, a, mx, exists and redirect counts, and past ten the check fails.

Should it end in ~all or -all?

Either works once DMARC is set. -all tells receivers to refuse what the list does not name. ~all marks it as suspect.

Can a domain have two SPF records?

No. Two records make SPF fail. Merge them into one.

The whole site

One page is one part. A read checks every page against the whole rulebook and says what to fix first.

See allbirds.com’s report