Free SPF check

SPF (Sender Policy Framework) is a TXT record in your DNS that sets out which mail servers are allowed to send email on behalf of your domain. Receiving mail servers check this record to decide whether an incoming message comes from a permitted source.

An SPF record looks roughly like this: v=spf1 include:_spf.yourprovider.com -all. It always starts with v=spf1, contains one or more mechanisms (such as include: for an external sending party) and ends with an "all" mechanism that decides what happens to senders not named explicitly.

That last mechanism is also where most mistakes are made: +all literally allows everyone and offers no protection at all, ?all makes no clear statement, ~all ("soft fail") usually marks unknown senders as suspicious without blocking them, and -all ("hard fail") turns them away. For a production domain, -all is the starting point.

Two other common problems: a domain with no SPF record at all (in which case anyone can pose as a sender), and a domain with several SPF records side by side. That is not allowed, because DNS permits only one SPF TXT record per domain and several records make the outcome unpredictable.

SPF on its own is not enough: it only checks the invisible "envelope from" address, not the sender address you see in your mail program. For that you need DKIM and DMARC, which sit on top of it.