Auditoría en profundidad de directivas v=spf1: validación de sintaxis, mecanismos include, ip4, ip6 y verificación del límite de 10 consultas DNS.
Stateless edge execution • Zero database retention • No user tracking or behavioral profiling
Every network lookup executes inside a temporary, isolated V8 sandbox deployed across Cloudflare's global edge. Each isolate is instantiated on demand, parses public DNS or TLS socket records in transient RAM, returns the result stream, and terminates immediately.
IncogSay operates under a strict zero-retention guarantee. Target domains, submitted URLs, and user IP addresses are never written to disk, stored in relational databases, or logged in persistent files. We do not maintain historical query logs or link lookups to user identities.
All tools are completely free and functional without registration, user logins, or account creation. We never deploy invasive session fingerprints, third-party analytics trackers that capture input payloads, or behavioral profilers. Your queries remain ephemeral and anonymous.
Escribe tu dominio de envío de correo (ej. miempresa.com).
Haz clic en "COMPROBAR REGISTRO SPF" para consultar los registros DNS TXT autorizados.
Verifica que el número total de mecanismos include y a/mx no supere el límite de 10 consultas.
Asegúrate de que la política de cierre (~all o -all) coincida con la configuración de tus servidores de envío.
Desde principios de 2024, los principales proveedores de correo electrónico exigen de forma obligatoria la presencia de registros SPF y DKIM alineados para remitentes masivos. Un registro SPF defectuoso o con exceso de lookups destruye la reputación del remitente e impide la entrega en la bandeja de entrada.
Enterprise email delivery relies on a four-tier cryptographic and policy stack. This tool executes statelessly against public authoritative nameservers to audit each protocol layer in real time.
Validates the Return-Path against designated sending MTA IP ranges. Strictly calculates recursive lookup depth against the 10-DNS-query boundary to prevent delivery-breaking permerror statuses.
Retrieves public RSA (2048-bit minimum) or Ed25519 public keys at selector DNS records, ensuring cryptographic non-repudiation and transit tamper detection for canonicalized body hashes.
Enforces strict alignment between the visible From domain and SPF/DKIM authenticated identifiers. Dictates receiver disposition across none, quarantine, and reject policies.
Enforces TLS in transit via MTA-STS policy files and renders verified trademarked SVG Tiny PS brand logos under VMC certificates in Gmail, Yahoo, and Apple Mail inboxes.
Common administrative and operational scenarios solved by this tool
Audit sending domains against Google and Yahoo's mandatory bulk sender requirements. Confirm that your domain publishes valid SPF and DKIM records, maintains strict DMARC alignment, and prevents rejection when delivering to over 5,000 daily consumer recipients.
Identify when combining multiple SaaS providers (Google Workspace, Zendesk, Mailchimp, Salesforce) causes your SPF record to exceed RFC 7208's strict 10-lookup threshold, triggering permanent authentication failures at receiving mail gateways.
Verify whether your domain allows bad actors to forge your sender address in phishing campaigns. Test whether your DMARC policy enforces quarantine or reject, stopping business email compromise (BEC) and unauthorized outbound spoofing.
Confirm that automated marketing platforms and transactional gateways (SendGrid, Postmark, Amazon SES) have published valid 2048-bit DKIM keys at their assigned selector records before initiating outbound marketing or password-reset campaigns.
Direct, peer-reviewed engineering answers to core deployment, troubleshooting, and compliance questions.
El RFC 7208 establece que los servidores de correo receptores abortarán la evaluación con error PermError si un registro SPF requiere más de 10 consultas DNS para resolverse. Esto provoca que tus correos legítimos caigan en spam.
El calificador ~all (SoftFail) indica que los remitentes no autorizados deben ser marcados pero aceptados para inspección. El calificador -all (HardFail) instruye al servidor receptor a rechazar tajantemente el correo no autorizado.