SPF Tree: SPF, DKIM, DMARC & MX Checker

Check any domain's SPF, DKIM, DMARC and MX records in one click, with a recursive SPF lookup count against the limit of 10.

SPF Tree audits a domain's email authentication in one click. Open it on any site and it reads that domain's SPF, DKIM, DMARC and MX records over DNS, then scores the setup out of 100 and explains every problem it finds in plain English with the exact fix. Its main job is the SPF lookup count. The SPF specification allows a maximum of 10 recursive DNS lookups. Go over it and receiving mail servers stop evaluating and return a permerror, which most treat as an authentication failure. Mail starts landing in spam and nothing tells you why. Most SPF checkers count only the mechanisms visible on your root record. That is the wrong number. A single include can expand into eight or nine more underneath it, so a record that looks fine at a glance can be well over the limit. SPF Tree follows the entire chain and shows it as a tree with the cost of every branch, so you can see which sender is expensive and how many lookups you need to remove. WHAT IT CHECKS SPF: full recursive lookup count against the limit of 10, the expanded include tree with per branch cost, multiple record detection, the all qualifier explained (-all hardfail, ~all softfail, ?all neutral, +all dangerous), redirect handling, macro terms, void lookups against their separate limit of 2, deprecated ptr mechanisms, and include loops. DMARC: policy, subdomain policy, percentage, aggregate and forensic report addresses, and DKIM and SPF alignment mode. Falls back to the organisational domain correctly on subdomains, so it will not wrongly report a missing record. DKIM: probes 19 common selectors, reports key type and RSA key length, and flags 1024 bit keys as weak and revoked keys. You can add your own selector. MX: records with priorities, and the mail provider identified from the hostnames. WHO IT IS FOR Anyone whose email has to arrive. Cold outreach and sales teams running Instantly, Apollo, Smartlead or Lemlist. Agencies auditing a client's domain before the first send. IT and DevOps engineers migrating a mail provider. Founders checking their own domain before a campaign. Consultants who need a report they can hand over. HOW IT WORKS No account, no signup, no server. Every check runs in your browser using public DNS over HTTPS. Nothing is uploaded, nothing is tracked, and there is no analytics or telemetry of any kind. The only network requests are ordinary public DNS queries for the domain you are auditing. Your last ten domains stay in local browser storage on your own device. Free, with no paid tier and no limits on the number of domains you can check.