How this check works
We select TXT records beginning with v=spf1, check common syntax and qualifiers, and inspect up to five first-level include names. Missing or duplicate policies need review; a timeout is inconclusive. Confirm any change by testing mail from each authorized service.
One policy, multiple senders
A domain should publish one SPF TXT record. When adding a new mail service, combine its authorized sources with the existing policy instead of adding a second v=spf1 record.
Know the scope of this check
We inspect mechanisms and up to five first-level includes. We do not evaluate a particular sender IP, expand SPF macros, or calculate a complete recursive lookup count. A passing basic check is not a full SPF evaluation.
Common questions
What is the difference between ~all and -all?
~all expresses soft failure for unmatched senders; -all expresses failure. Both depend on the preceding mechanisms being complete and accurate.
Can I fix SPF by deleting an include?
Only remove an include after confirming its service no longer sends legitimate mail. Removing an active sender can break authentication.