RFC 7208 policy scoring

Is your SPF policy strong enough — or one bad flag away from letting spoofers impersonate your domain?

Paste any sending domain and we'll resolve the SPF TXT record at the apex, parse the RFC 7208 mechanisms (qualifier · type · value), check against the four concrete axes the protocol specifies — the all-qualifier posture (- / + / ~ / ?), the DNS-lookup budget against the §4.6.4 cap of 10, the §3.2 single-record discipline, and the §5.5 deprecation of `ptr` — and ask the analyst for a 0-100 score plus 3-5 plain-English findings.

Check the SPF policy at any domain
Paste a sending domain and we'll resolve the SPF TXT record at the apex, parse the RFC 7208 mechanisms (qualifier · type · value), and ask the analyst for a 0-100 score plus 3-5 plain-English findings. The summary anchors on four concrete axes — all-qualifier posture (-all / ~all / ?all / +all), the DNS-lookup budget against the §4.6.4 cap of 10, the §3.2 single-record discipline, and the §5.5 deprecation of `ptr`.
Continuous SPF posture monitoring?
One email and we'll let you know when ReputaPilot opens up — continuous posture tracking across SPF, DKIM, DMARC, MX, blocklists, and inbox placement, with an alert the moment a record flips or an include: chain sends you over the §4.6.4 cap of 10.

Drop your email above — we'll only ping you about the monitor. No newsletters, no upsells.

Have a specific question? Email us

FAQ

SPF record checker — frequently asked questions

Related sender-reputation check

Check blocklist status too

SPF, DKIM, and DMARC cover authentication; blocklist status is another part of sender reputation. Check your sending domain or IP against DNS blocklists.

Run the blacklist lookup checker →

Pair this checker with the guide

Want the step-by-step walkthrough?

The SPF record setup guide explains how SPF works in the receiver — what the `v=spf1 include: … -all` line actually does, how `include:` chains accumulate against the §4.6.4 cap of 10, why `+all` is an immediate fail, and how a published TXT at the apex gates you from `?all` (no enforcement) to `~all` (softfail) to `-all` (the gold-standard Google + Yahoo enforce for the bulk-sender floor). Read it when you are publishing SPF for the first time, then come back here to confirm the record you just wrote scores well.

Read the SPF record setup guide →

Pair this checker with the guide

Looking for the complete authentication setup walkthrough?

SPF is one of four DNS-published protocols that compose the authentication floor — SPF, DKIM, DMARC, and BIMI — what each does in the receiver, the order to publish each record so the next layer does not break the previous one, and why Google and Yahoo made all four mandatory in 2024. SPF is the entry-level allowlist; read the pillar before publishing it for the first time on a new domain.

Read the email authentication guide →