SPF lists which hosts may send mail as your domain. Receivers still accept forged mail when the record is missing, permerrors, or ends in ~all. This checker follows the include chain, counts DNS lookups against the RFC 7208 limit of 10, and tells you whether the terminator is hard-fail (-all) or only a soft fail.
Public assessments are free. No account. The full 0–100 stack is included below the focused result.
Figures from the July 2026 Top-1M study.
The apex TXT that starts with v=spf1, plus the include and redirect chain it pulls in. SecLens reports the effective terminator (all), the lookup count, and syntax errors that make receivers treat the record as a permerror.
-all is hard fail: unauthorized senders should be rejected. ~all is soft fail: mail is usually marked but still delivered. Most Top-1M publishers still use ~all. Soft fail earns fewer points than hard fail on this scale.
RFC 7208 caps the number of DNS lookups at 10, including includes and redirects. Over that, receivers must permerror the record, which can fail both legitimate and forged mail. Flatten or drop mechanisms until the count is 10 or below.
Scoring rules are on the methodology page. The homepage still has the full product, including the live Pulse.