What the SPF check looks at
SPF is a DNS record that lists the servers allowed to send email for your domain. It ends with an "all" rule that covers every other server. We look up your SPF record and read that final rule:
- No SPF record — flagged critical. Receiving servers have no list to check senders against.
- +all — flagged critical. It tells receiving servers that any server may send as you.
- ?all — flagged high. "Neutral" gives receivers no instruction, so it offers no protection.
- ~all or -all — not flagged. Mail from other servers is treated as suspicious (~all) or refused (-all).
If the DNS lookup doesn't complete, we say we couldn't verify the record instead of reporting it as missing.
Why it matters
A customer gets an email from what looks like your accounts address: your bank details have changed, please pay this month's invoice to the new account. Their mail server checks your SPF record to decide whether the server that sent it is allowed to send for you. With no SPF record, or one ending in +all or ?all, it has no reason to turn the message away.
SPF works together with DMARC, which tells receiving servers what to do with mail that fails. The same scan checks both; the DMARC checker explains the DMARC side.
What this check doesn't cover
We read the record and its final rule. We don't count the DNS lookups inside the record or confirm that every server it lists is really yours. Your email provider can tell you which entries your account needs.
Free scan or Pro
The free scan shows every issue it finds, how serious each one is and what it means, in plain English, plus your Ghost Score out of 100. No account needed.
Pro adds step-by-step fix instructions for each issue, a Top-3 action plan, a PDF report and your score history, for domains you have verified you own.
Questions
What does the SPF checker check?
It looks up the SPF record in your domain's DNS and reads the "all" rule at the end. A missing record and +all are flagged as critical, ?all as high. ~all and -all are not flagged.
Is ~all good enough, or do I need -all?
The scan treats both as protective and flags neither. With -all, receiving servers are told to reject mail from servers not on your list; with ~all, they are told to treat it as suspicious.
Does it check DMARC and DKIM too?
Yes. The same scan checks your DMARC record and tries 14 common DKIM selector names, and also scores your SSL/TLS setup, security headers and more.
Is the SPF check free?
Yes. The scan, your Ghost Score and every finding with its explanation are free, with no account needed. Step-by-step fix instructions are part of Pro.