SPF IP Analysis — Every Authorized IP Checked Individually

Why the individual IPs matter

An SPF record returning pass only tells you that the one server which just sent is authorized. It says nothing about the state of all the other authorized servers. If your record pulls in a provider via include:, you may be authorizing several hundred IP addresses — and you carry the reputational consequences for every one of them.

This analysis makes visible what your SPF record actually permits. If one of the authorized IPs is blacklisted, that is a deliverability risk even when your own sending IP is clean.

How resolution works

The record is walked recursively up to depth 3 and every mechanism is evaluated:

• ip4: — single IP or CIDR range. Networks of /24 and smaller are expanded, larger blocks are flagged as ranges
• ip6: — IPv6 address or range, always treated as a range
• a / a:host — A and AAAA records of the host or origin domain
• mx — all MX records, then A and AAAA of every MX host
• include: — the included domain's SPF record is opened and evaluated the same way

What is checked per IP

• Blacklist status against the 8 most relevant DNSBLs
• Reverse DNS — does a PTR record exist for the IP?
• FCrDNS — the PTR hostname is resolved back and checked for the original IP. Only then does reverse DNS count as confirmed
• ASN and organization via Team Cymru DNS — you see who actually owns the IP

For ranges the network address is used for the ASN lookup. IPv6 is fully covered: AAAA resolution, blacklist queries via expanded nibbles, FCrDNS with AAAA query and ASN via origin6.

What to do with the result

• Too many authorized IPs is a risk in itself. The larger the authorized surface, the more third-party reputation is attached to your domain.
• Listed IPs inside your own record need attention — either report them to the provider or drop the include:.
• Missing FCrDNS on your own sending IPs is a classic reason for being classified as spam.