SPF record

What this check looks at

Authentication group · check id spf · all thirteen checks

“SPF lists the servers allowed to send as you. Present, and syntactically valid?” - the wording shown beside this check while it runs.

SPF - Sender Policy Framework - is a single line of text published in your DNS naming the servers permitted to send mail using your domain. A receiving server compares the server that actually delivered the message against your list.

It always starts v=spf1 and ends with an instruction about everything not on the list: -all means "reject anything else", ~all means "treat anything else as suspicious", and ?all means "no opinion", which is the same as having written nothing at all.

v=spf1 include:_spf.google.com include:servers.mcsv.net -all

Why it matters

Without SPF a receiver has nothing to compare a delivering server against, so one of the two ways of proving a message is really yours is simply absent. It also removes one of the two inputs DMARC needs, which caps how much protection a DMARC policy can give you.

Two SPF records is worse than none. The standard says a domain with more than one SPF record is a permanent error, and receivers are entitled to ignore both. This is the single most common way a well-intentioned addition breaks a working setup: a new provider tells you to "add this SPF record" and you add a second line instead of merging it into the first.

What each verdict means here

Pass

One valid SPF record is published.

Warn

Published but weak or questionable - commonly ending in ?all, or authorising far more of the internet than it needs to.

Fail

No SPF record, more than one SPF record, or a record that does not parse.

What to do

1. If there is no record, start from the one your mail provider documents and add every other service that sends as you.
2. If there are two, merge them into one line. Every include: from both records goes into a single v=spf1 record.
3. Prefer -all once you are confident the list is complete; ~all is the safe position while you are still finding senders.
4. Then re-run this check and read the lookup budget result below, because a longer list costs lookups.

What this check does not do

We read what is published. We cannot tell you which senders you have forgotten - only the DMARC reports you receive over time can, and collecting those for you is on the roadmap rather than built.