Check a bounded record syntax subset and expose unresolved SPF lookup expansion without probing DNS.
Security
Offline SPF and DMARC record lab
Check a bounded record syntax subset and expose unresolved SPF lookup expansion without probing DNS.
Example inputs · Replace these with your measurements to build your plan.
Method, example and sources
Read SPF mechanisms and count local DNS-dependent terms.
Add only explicitly supplied nested/path lookup terms; preserve unknown expansions.
Check DMARC version, duplicate tags, policy and alignment mode syntax.
Flag a supplied lookup-term budget above ten and identify removed legacy pct usage.
Worked example. One include gives one local DNS-dependent term. With unknown expansion the result remains review-needed; eleven entered total terms exceeds SPF's limit.
This is an offline SPF term budget and DMARC policy linter, not authentication or a DNS test.
Local DNS-dependent SPF terms
1
Entered expansion total
unknown
Syntax/budget findings
0
DMARC policy
reject
Nested includes, address expansion and void lookups are unknown; a budget pass cannot be verified.
SPF term counting is a conservative supplied-path budget, not a complete check_host evaluator. DKIM signatures, identifier alignment and DMARC DNS tree walking are not tested.
From the catalog
Network Security & Firewalls
Explore related listings, then confirm the exact model requirements against your plan. These listings are not an automatic compatibility or capacity verdict.
An SPF record can look short while its included domains cause many additional lookups. This lab keeps local terms separate from nested expansion and never treats an unresolved include as zero. It also checks a small DMARC policy syntax subset. Current DMARC RFC 9989 replaces the older percentage tag with a testing flag.
What to verify next
Syntax and a supplied term budget do not authenticate a message. The tool does not query DNS, validate DKIM signatures, perform DMARC organizational-domain discovery or inspect reporting destinations. Some SPF terms depend on evaluation order and additional address queries, so a complete receiver evaluation can find further errors. Use real mail traces and authoritative domain data before changing enforcement policy.
Worked example
One include gives one local DNS-dependent term. With unknown expansion the result remains review-needed; eleven entered total terms exceeds SPF's limit.
