Look up the SPF record published for a domain and see how its final all mechanism is configured. The check uses live public DNS and needs only a domain name.
SPF lets a domain publish which infrastructure is authorised to use that domain in SPF-authenticated email identities. The checker reads TXT records at the domain and isolates the SPF1 policy when one is present.
A real SPF result is calculated for a particular SMTP identity and sending IP. Includes and redirects can lead to additional DNS work, so a record-only lookup cannot determine whether every sender will pass SPF.
SPF also does not authenticate the visible From address by itself. DMARC uses SPF only when the authenticated SPF identifier aligns with the Author Domain.
Illustrative record: v=spf1 ip4:192.0.2.10 -all. The documentation-only IP represents one authorised sender; unmatched IPs produce fail. It is not a record to copy into production. ~all produces softfail, ?all neutral, and +all permits any sender reaching that mechanism.
SPF evaluation has a limit of ten DNS-querying terms, including work reached through includes and redirects. The direct mechanism count shown here does not prove that you are within that limit. Use your provider's full evaluation for the actual sending IP and SMTP identity before changing a record.
If multiple SPF records are found, combine legitimate sender instructions into one policy with your mail administrator rather than adding another SPF record. Check DMARC alignment separately, then use the free website security scan for the surrounding website and domain signals.
This utility checks one email-authentication signal. ThreatScout's free website security scan also reviews HTTPS, security headers, DNS and the broader email-protection configuration.
Run the full free website security scanYes. It queries the domain's public TXT records and displays the SPF policy without requiring signup.
-all is the fail qualifier for senders that did not match an earlier SPF mechanism. The effect on a received message still depends on the receiving system and other authentication checks.
~all is the softfail qualifier. It indicates that unmatched senders are probably not authorised, but the receiving system decides how to use that result.
A domain should publish a single SPF record. Multiple SPF records can produce an SPF permanent error rather than combining into one policy.
