SPF Record Checker reads the SPF record on a domain and validates it against the rules that actually break delivery. SPF lists which servers are allowed to send mail for your domain, published as a TXT record starting with v=spf1. The tool checks the two things most likely to be wrong. The first is the ending mechanism: -all hard fails everything not listed and is the strict setting, ~all soft fails and is useful while testing, while +all or a bare all authorises the entire internet and defeats the point of having a record. The second is the DNS lookup limit. RFC 7208 permits at most ten mechanisms that trigger a DNS query, counting include, a, mx, ptr, exists and redirect, and exceeding it makes the whole record return permerror, which fails as though SPF were misconfigured entirely. This is easy to hit because each provider you add through an include may itself expand into several more lookups. The tool counts the mechanisms in your record and warns as you approach the ceiling. A domain must also publish exactly one SPF record, since a second makes both invalid. Pair with DMARC Record Checker to see how failures are actually treated.
DNS resolution happens in multiple stages. When you type a domain name, your browser first checks its own cache, then the OS resolver cache, then queries your configured DNS resolver (usually your ISP or a public resolver like 8.8.8.8 or 1.1.1.1). If none have the record cached, the resolver performs a recursive query: it asks the root name servers for the TLD servers (.com, .net, etc.), then asks the TLD servers for the authoritative name servers of the specific domain, and finally asks the authoritative servers for the actual record. This entire process typically completes in under 100ms. DNS-over-HTTPS (DoH) encrypts DNS queries in HTTPS traffic, preventing ISPs and network observers from seeing which domains you query. It was standardized in RFC 8484 in 2018 and is now supported by all major browsers. Google and Cloudflare both operate free public DoH endpoints (dns.google and cloudflare-dns.com). TXT records have become a critical security mechanism: SPF (Sender Policy Framework) records specify which servers are allowed to send email for a domain, DKIM (DomainKeys Identified Mail) records provide public keys for verifying email signatures, and DMARC records tell receiving mail servers what to do when SPF or DKIM checks fail. Checking these records is the first step in diagnosing email deliverability problems.