Skip to content

SPF checker

SPF lists which hosts may send mail as your domain. Receivers still accept forged mail when the record is missing, permerrors, or ends in ~all. This checker follows the include chain, counts DNS lookups against the RFC 7208 limit of 10, and tells you whether the terminator is hard-fail (-all) or only a soft fail.

Public results are listed under "Last assessed domains". What we store

Public assessments are free. No account. The full 0 to 100 stack is included below the focused result.

Assessments are free and always will be. SecLens.ONE is funded by its operator, 42Sec PTE. LTD. There is no paid tier, no API product and no monitoring service today. A private assessment (see the checkbox in the scan dialog) is the only difference.

89.5%
of mail-enabled Top-1M domains publish SPF
33.9%
end the record in -all

Figures from the October 2026 Top-1M study.

The same assessment, protocol by protocol

Every checker below runs the full SecLens.ONE assessment and leads with its own result. The scoring weights are on the methodology page.

DMARC checker

DMARC tells receiving mail servers what to do with messages that fail SPF or DKIM for your domain.
DKIM checker

DKIM signs outbound mail so receivers can prove a party that controls your domain sent the message.
MTA-STS checker

MTA-STS tells sending servers to use TLS to your MX hosts and to refuse a downgrade.
DANE checker

DANE binds MX certificates to DNS with TLSA records, but only if DNSSEC is actually validating.
TLS-RPT checker

TLS-RPT is how sending servers tell you that STARTTLS failed on the way to your MX.
Email security score

SecLens.ONE scores a domain from 0 to 100 across seven email-security protocols, using the same live DNS checks as the rest of the product.
Email spoofing check

If a domain publishes no DMARC policy, or publishes p=none, anyone can send mail that looks like it came from that domain.

Common questions

What does an SPF lookup show?

The apex TXT that starts with v=spf1, plus the include and redirect chain it pulls in. SecLens.ONE reports the effective terminator (all), the lookup count, and syntax errors that make receivers treat the record as a permerror.

Why is -all stronger than ~all?

-all is hard fail: unauthorized senders should be rejected. ~all is soft fail: mail is usually marked but still delivered. Most Top-1M publishers still use ~all. Soft fail earns fewer points than hard fail on this scale.

What is the SPF lookup limit?

RFC 7208 caps the number of DNS lookups at 10, including includes and redirects. Over that, receivers must permerror the record, which can fail both legitimate and forged mail. Flatten or drop mechanisms until the count is 10 or below.

Scoring rules are on the methodology page. The homepage still has the full product, including the live Pulse.