SPF Checker
Find and inspect the SPF policy published for any domain.
What is an SPF record?
SPF (Sender Policy Framework, RFC 7208) lists which servers are allowed to send mail using your domain in the envelope sender. It is published as a TXT record on the domain itself, beginning with "v=spf1".
A domain must publish at most one SPF record. Two SPF TXT records is a configuration error, and receivers are expected to treat it as permanently failing rather than picking one.
Reading the mechanisms
Mechanisms are evaluated left to right. "ip4:" and "ip6:" authorise addresses directly, "a" and "mx" authorise the domain’s own address and mail-exchanger hosts, and "include:" pulls in another domain’s policy — which is how hosted mail providers are typically authorised.
The final term sets what happens when nothing matched. "-all" is a hard fail, "~all" is a soft fail that asks receivers to accept but mark the message, and "?all" expresses no opinion at all.
What the result means
RFC 7208 defines seven outcomes, and they are not simply pass or fail. None means the domain publishes no SPF record at all. Neutral means it publishes one that declines to express an opinion about the sender.
Pass, fail and softfail are the three that reflect a policy decision: the sender was authorised, was not, or was not but the domain asked receivers to accept the message anyway and mark it.
Temperror and permerror are faults in the evaluation rather than verdicts on the sender. A permerror usually means the record is malformed, duplicated, or over the lookup limit below, and a receiver treating it as unusable is behaving correctly.
The ten-lookup limit
SPF evaluation is capped at ten DNS-querying mechanisms — include, a, mx, ptr, exists and redirect all count. Exceeding it produces a permanent error, and receivers are expected to treat the result as unusable rather than ignoring the limit.
Long chains of nested "include:" terms are the usual cause. Each provider you add pulls in its own includes, so the count grows faster than the record looks.
What a passing SPF record still will not stop
SPF authorises the envelope sender, the address used in the SMTP exchange, not the From address a recipient actually sees. A message can pass SPF cleanly while displaying any From address at all, which is why SPF on its own is not an answer to spoofing.
It also breaks on forwarding. A forwarded message reaches the destination from the forwarder’s server, which the original domain never authorised, so a legitimate message fails through no fault of the record.
Both gaps are why SPF is normally deployed alongside DKIM, which survives forwarding, and DMARC, which ties authentication to the visible From domain and accepts either one.