What it reads
The record's all term, after any redirect, and whether each include and redirect still publishes an SPF record. An all term of +all or ?all fails, and an include or redirect with no SPF record warns.
Check 11 of 54 · Email authentication
SPF hygiene, explained.
An SPF record that lets anyone send, or still points at a supplier you left.
Engine 1.57.0, read 25 October 2026
Free checkScoredReliability: Definitive
Can someone send email as you?
What the check does, and where it stops.
Why it matters
A record ending +all approves the whole internet, and one ending ?all protects nothing either. An include that points at a lapsed domain can be re-registered by a stranger, who then sends as you with your blessing.
What a failure looks like
A failure is a finding in your result. The check is scored, so it can lower your score, and the Full Report gives every finding its severity and a fix. If the check cannot finish, it is recorded as unknown: it carries no penalty, and it is never a pass.
Where its limits are
A dangling include is a risk, not proof that anyone has claimed it.
ReliabilityDefinitive: reads a published value
Check 11 is one of 16 in Email authentication. See it in its row on the scanner page, beside the rest of Email authentication.
Run this check on any domain. Free, with no account.
The SPF checker runs it on its own. It reads the record that lists the servers allowed to send email as you, and counts the DNS lookups it costs.
See how your domain does.
The free check includes this one and takes about 30 seconds. No account. Nothing to install.