Skip to main content

​
Where to find it

Select DNS Tools in the left navigation, then the SPF Scanner tab. Enter a domain and select Check SPF.

​
Reading the results

The SPF Record card shows a Valid or invalid badge, the full record with a copy control, and an advisory line calling out anything worth tightening — for example, “Using ~all (softfail) is good but -all is more strict.” Three figures summarise the record:

​
The ten-lookup limit

SPF allows a maximum of ten DNS lookups when a record is evaluated. Go over it and receiving servers return a permanent error, so your SPF stops working even though the record still looks correct. Every include: costs at least one lookup, and an include that itself contains includes costs more. DNS Lookups is the figure to watch as you add senders.

​
Mechanisms

Each mechanism is listed with the result it produces and the provider it refers to:
  • Pass — the sender is authorised. Each include: names the provider it pulls from.
  • SoftFail — produced by ~all, marking anything not listed above as suspicious but still deliverable.
  • Fail — produced by -all, rejecting anything not listed.

​
Protected by DMARCeye

When the scanned domain is monitored in your account, a Protected by DMARCeye panel confirms it below the results. To build or change an SPF record rather than inspect one, use the SPF Configuration path in the DMARC Configurator.