Loading Empire…

Skip to content

Learn Fix Tools

Search/

Appearance

Filter tools…

Authentication
Deliverability
Monitoring
- Google Postmaster Tools
- Microsoft SNDS
Email Validation
DNS
Inbox Placement
- Inbox Monster
Testing
- Mail-Tester
- GlockApps
Analytics
- Google Analytics 4
Infrastructure
- Cloudflare DNS
Automation
- Customer.io
ESPs
Development
- Swaks
Utilities
- WHOIS / RDAP

Home
Tools
Authentication
Kitterman SPF validator

Kitterman SPF validator

Classic web SPF policy evaluator used by operators for syntax checks.

Reading time:: 5 min
Difficulty:: Intermediate
Estimated duration:: 5 min
Prerequisites:: None
Last updated:: 2026-07-15
Author:: empire

Overview

Classic web SPF policy evaluator used by operators for syntax checks.

Vendor: Scott Kitterman

Primary purpose

Validate SPF record syntax and evaluation behavior.

Best for

Catching SPF syntax and mechanism mistakes

Common use cases

Test a draft SPF string
Reproduce an SPF permerror

Advantages

Long-standing, focused SPF checker

Limitations

UI is dated
Does not replace dig at the authority

When not to use it

You need continuous monitoring

Pricing

Free web utility.

Official website

www.kitterman.com/spf/validate.html

Inputs and outputs

Typical inputs

Domain or SPF string
Optional sending IP

Typical outputs

SPF evaluation results

Privacy notes

Review each vendor’s data handling before uploading production lists or message content.

Related learning

SPFSender Policy Framework — authorizes hosts that may send for a domain.

Related problems

Invalid SPF mechanismSPF record contains unsupported or malformed mechanisms.
Broken SPF includeAn included SPF domain is missing, invalid, or fails closed.
Forwarded email fails SPFForwarding paths break SPF because the forwarder is not authorized.
Incorrect IP authorizationSending infrastructure IPs are not authorized by SPF.
Multiple SPF recordsMore than one SPF TXT record exists, causing evaluation failure.
SPF passes but DMARC failsSPF authenticates a domain that does not align for DMARC.
SPF PermErrorSPF evaluation fails permanently due to policy or lookup errors.
SPF record missingNo SPF TXT record is published for the sending domain.
SPF TempErrorTemporary DNS or evaluation failure during SPF checks.
Too many DNS lookupsSPF evaluation exceeds the ten-lookup limit.

Related tools

digCLI DNS lookup utility for authoritative and recursive inspection of mail-related records.
MXToolboxPopular DNS and mail diagnostics suite for SPF, DMARC, blacklist, and MX checks.
Mail-TesterSend-a-message spam and authentication scoring for pre-send QA.

Workflows

Open step-by-step: Configure SPFPublish and validate an SPF policy for authorized senders.
Open step-by-step: Authenticate a new domainPublish SPF, DKIM, and DMARC for a new sending domain and verify authentication before warmup.
Open step-by-step: Migrate authentication recordsMove SPF, DKIM, and DMARC to a new platform without dual-record failures.

Continue Learning

Open step-by-step: Configure SPFPublish and validate an SPF policy for authorized senders.

PreviousDKIMCore NextURIports tools

Company

About
Contact
Services

Platform

Learn
Fix
Tools

Community

Empire is a living operator community — share practice, follow releases, and help shape the knowledge base.

Newsletter — coming soon

Legal

Privacy Policy
Terms of Use
Disclaimer
Editorial Policy
Cookie Policy

© 2026 Empire Email

Independent educational platform focused on email infrastructure, deliverability, and lifecycle marketing.