SPF
This checker reads the SPF TXT record published in your domain’s DNS and passes it only if the record exists, stays within the 10-lookup limit, and ends in -all so unauthorised senders are rejected outright.
Questions
A TXT record starting v=spf1 that lists which servers may send email as your domain. Receivers check the sending server against the list. Mail from anywhere else fails SPF. If DKIM does not pass in alignment either, a DMARC policy junks or rejects it.
SPF processing allows at most 10 DNS lookups per check, counted recursively through every include, a, mx, ptr, exists and redirect. Every SaaS tool you authorise spends lookups, and past 10 the record returns a permanent error and stops protecting you. This checker counts them recursively through the include chain; if a chain nests deeper than the scan follows, it says so rather than calling the record healthy.
-all tells receivers to hard-fail unauthorised mail; ~all only marks it. Use ~all while testing changes, then move to -all. If your record ends in +all, the entire internet is authorised to send as you. Fix that today.
No. The standard allows exactly one; a second record makes SPF permanently fail validation. Merge them into a single v=spf1 line.
A pass means your domain has exactly one SPF record, it resolves within the 10-DNS-lookup limit, and it ends in -all or ~all so receivers know which servers may send as you.
A failure means your domain has no SPF record, has more than one (which breaks validation), exceeds the 10-lookup limit, or ends in +all and authorises any server on the internet to send as you.
Publish a single v=spf1 TXT record listing your real sending servers, remove any extra SPF records, cut includes until you are under 10 lookups, and move the record from ~all to -all once you have tested the change.
Free
Paste it, and the rule-set from 4,000,000 sends scores it. The report lands in your inbox in minutes, and a full three-step sequence written for your ICP follows from Hugo a few hours later.
EMPRA