SPF Check — Verify Your Sender Policy Framework

What is SPF?

The Sender Policy Framework (SPF, RFC 7208) is a DNS TXT record in which you declare which servers may send email on behalf of your domain. The receiving mail server reads that record, compares it against the IP address of the incoming connection, and decides whether the sender is authorized.

SPF is the first of the three building blocks of email authentication. Without a valid SPF record, virtually any server can send email using your domain as the sender — the foundation for spoofing and phishing in your name.

What AnalyzeMy.Email checks

This check goes well beyond pass/fail. Your SPF record is fully audited against RFC 7208:

• Validation result: pass, fail, softfail, neutral, none or permerror — computed with the pyspf library against the actual sending IP
• Record syntax: correct v=spf1 prefix, malformed terms, invalid ip4:/ip6: values
• DNS lookup limit: recursive counting across every include: and redirect= chain. RFC 7208 allows a maximum of 10 lookups; beyond that the record returns permerror. You get a breakdown of which mechanism causes how many lookups
• Void lookups: at most 2 queries may return NXDOMAIN or an empty answer. Every a, mx, exists, include and redirect is actually resolved to measure this
• Sub-limits: the mx mechanism may return at most 10 MX records, ptr at most 10 PTR records
• all qualifier: -all, ~all, ?all, +all, missing all, multiple all, and unreachable terms after all
• Legacy issues: deprecated ptr:, redirect= combined with all, duplicate mechanisms, record length over 255 characters, macros

Reading the results

• pass — The sending server is authorized in the record. This is the goal.
• fail (-all) — Not authorized and the domain explicitly rejects it. Receivers may discard the message.
• softfail (~all) — Not authorized, but the domain only asks for marking rather than rejection. Too weak as a permanent state.
• neutral (?all) — The domain makes no statement. Provides essentially no protection.
• none — No SPF record exists. Your domain is unprotected.
• permerror — The record is malformed or exceeds the lookup limit. Receivers often treat this as "no SPF".

Common failure causes

• Lookup limit exceeded: Anyone combining Google Workspace, a newsletter tool and a CRM via include: passes 10 lookups quickly. The entire record then becomes invalid — including the part that used to work.
• Multiple SPF records: A domain must have exactly one v=spf1 record. Two records produce permerror.
• Forwarding: On forwarded email the sending IP changes and SPF inevitably fails. That is what ARC is for, not SPF.
• Forgotten senders: Invoicing systems, monitoring and ticketing tools often send from their own IPs that were never added to the record.