Skip to content
SiteGuardiaSiteGuardia

Preferences

Check your SPF record

SPF lists the servers allowed to send email as your domain, and ends with a rule about everyone else. `-all` asks receivers to reject them, `~all` to accept but mark them, `?all` to take no position, and `+all` to allow anyone. This check reads which one you publish. It does not test delivery, and it does not follow every include chain a receiver would.

2 scans per site each day. No account. Nothing is exploited.

This check is part of the full reading. Entering an address runs all five categories.

What an SPF record says

It is a list, published in your DNS, of the servers allowed to send email using your domain. A receiving server reads it and compares it against where the message actually came from. The list ends with a rule that says what to do about everything not on it.

The ending is the whole record

The last rule in the record is the one about everybody not listed, and there are four of them. They are not two strict ones and two useless ones: `~all` is what a domain publishes while it reads its reports, and receivers do act on it. What this check reads is which of the four you publish, and it reports a permissive ending separately from a missing record rather than treating the two as the same problem.

  • -all: strict, and the goal
  • ~all: soft fail, asks receivers to accept but mark. The normal state while reading DMARC reports
  • ?all: neutral, which asks a receiver for no particular treatment
  • +all: accepts everything, worse than having no record

A domain that sends no email still needs one

If a domain has no mail service, publish v=spf1 -all and a DMARC record at reject. An unused domain with no records is a free identity for anyone who wants one, and parked domains are targeted precisely because nobody is watching them.