Sending policy
SPF publishes permitted sending sources in a TXT record beginning v=spf1. Publish one SPF record per name. include and redirect refer to other policies.
Common problems
Multiple records, missing dependencies and excessive DNS-using terms can cause errors. -all, ~all and ?all have different outcomes; +all permits every sender. Review all legitimate services before changes.
Static check versus a message
Our check inspects records and dependencies. It has no sender IP or message context and cannot issue an SPF pass. Macros and lookup counts depend on the actual evaluation path.
Reading an example
In v=spf1 include:_spf.example.com -all, the include refers to another published policy. The address space of that policy is not the same as the domain’s MX servers. Our result lists inspected dependencies separately. Do not copy this example into DNS: replace it with the settings supplied by your actual sending services.