Live SPF DNS lookup — queries DNS in real time and returns the SPF record, what receivers evaluate it to, DNS-lookup and void-lookup counts, parsed include tree, TXT diagnostics, errors and warnings. evaluation is what receivers' SPF check returns: ok (pass or fail then depends on the sending IP), none (no record), permerror or temperror. permErrorScope=record — receivers that follow RFC 7208 do not evaluate it as one record (a syntax error, several SPF records) and lookupCount 0 means "not counted"; with a syntax error SPF fails for every message, with several records (listed in records) receivers differ — some return permerror, some report fail, some evaluate one of the records — so the result is unpredictable; permErrorScope=evaluation — it breaks during evaluation (an include target without SPF, more than 10 DNS lookups, a 3rd void lookup): senders matched before that point still pass, every other sender gets permerror, senders listed later in the record included. Terms with ignored=true are never evaluated by receivers. voidLookups counts the lookups that return no records (receivers allow 2, RFC 7208 §4.6.4) for a sender the record does not list (192.0.2.1, without reverse DNS), up to where evaluation stops for it. An include or redirect whose target has no TXT records at all or does not exist counts too, beside its Critical error (a target with TXT records but no SPF does not). Terms whose name depends on the sender — exists, a or mx with a macro such as %{i}, and ptr — count too: they usually return nothing for such a sender, which is normal but counts toward the limit. A 3rd void lookup is a permerror (a Critical error, evaluation permerror), except when it is reached only with ptr: then only senders without reverse DNS get permerror, so evaluation stays ok and an Info error names the terms. That permerror does not stop the count: voidLookups goes on past the 3rd, so it can read 3 or more, and more than a later Critical error counts (that one leaves ptr out). voidLookups can also be lower than the void-lookup errors suggest: those judge each term, wherever it is. An include or redirect whose target depends on the sender (Proofpoint's include:%{ir}.%{v}.%{d}.spf.has.pphosted.com, Valimail's %{i}…) counts as one DNS lookup itself, but the terms of its target — a record of its own for each sender IP — count in neither lookupCount nor voidLookups; when that target takes the unlisted sender over either limit an Info error names the term and where receivers stop, and when the target does not exist for it, a Critical error with permerror. A name with a CNAME next to its own TXT records (DNS does not allow it, but some DNS hosts serve it) gets spfDnsConflict=true and a dns_record_found error with fix dns_fix_cname_txt_conflict, found by asking the zone's name servers directly. It is Critical when the two sides publish different SPF records: receivers that read the TXT at the name (such as Gmail and Yahoo) and receivers that follow the CNAME (such as Mail.ru and most Microsoft servers) check different records, so a sender authorized by only one of them fails SPF at the other group. It is a Warning when both sides publish the same SPF records, or neither has one. record, evaluation and the counts are then for the side this check's resolver returned (evaluation can stay ok), and txtDiag is that resolver's answer, which can show no CNAME (cnameAtQName=false); the error's text names both records. Does NOT require a project — works for any domain, even ones not monitored. Use this to verify SPF configuration, diagnose "too many DNS lookups" issues, or check a domain before adding it to a project.