This tool provides a way to query all IPs related to the SPF entry of a specific domain:
$ get_spf_ips gmail.com 172.217.0.0/19 216.239.32.0/19 216.58.192.0/19 209.85.128.0/17 207.126.144.0/20 173.194.0.0/16 108.177.8.0/21 74.125.0.0/16 72.14.192.0/18 66.249.80.0/20 66.102.0.0/20 64.233.160.0/19 64.18.0.0/20
This is done by recursively querying the TXT entries of the domain. For example, you can see that the first IPs printed above are extracted from something like the following:
$ dig TXT gmail.com | grep 'v=spf1' gmail.com. 225 IN TXT "v=spf1 redirect=_spf.google.com" $ dig TXT _spf.google.com | grep 'v=spf1' _spf.google.com. 161 IN TXT "v=spf1 include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com ~all" $ dig TXT _netblocks.google.com | grep 'v=spf1' _netblocks.google.com. 553 IN TXT "v=spf1 ip4:64.18.0.0/20 ip4:64.233.160.0/19 ip4:66.102.0.0/20 ip4:66.249.80.0/20 ip4:72.14.192.0/18 ip4:74.125.0.0/16 ip4:108.177.8.0/21 ip4:173.194.0.0/16 ip4:207.126.144.0/20 ip4:209.85.128.0/17 ip4:216.58.192.0/19 ip4:216.239.32.0/19 ~all"
get_spf_ips is known to work for gmail.com and outlook.com.
NOTE: As of this writing this tool does not provide sorting and deduplicaton of IP addresses. Also note that only IPv4 addresses will be provided.