Look up the SPF record published for a domain and see how its final all mechanism is configured. The check uses live public DNS and needs only a domain name.
SPF lets a domain publish which infrastructure is authorised to use that domain in SPF-authenticated email identities. The checker reads TXT records at the domain and isolates the SPF1 policy when one is present.
A real SPF result is calculated for a particular SMTP identity and sending IP. Includes and redirects can lead to additional DNS work, so a record-only lookup cannot determine whether every sender will pass SPF.
SPF also does not authenticate the visible From address by itself. DMARC uses SPF only when the authenticated SPF identifier aligns with the Author Domain.
This utility checks one email-authentication signal. ThreatScout's free website security scan also reviews HTTPS, security headers, DNS and the broader email-protection configuration.
Run the full free website security scanYes. It queries the domain's public TXT records and displays the SPF policy without requiring signup.
-all is the fail qualifier for senders that did not match an earlier SPF mechanism. The effect on a received message still depends on the receiving system and other authentication checks.
~all is the softfail qualifier. It indicates that unmatched senders are probably not authorised, but the receiving system decides how to use that result.
A domain should publish a single SPF record. Multiple SPF records can produce an SPF permanent error rather than combining into one policy.
