Does your domain publish an SPF record that refuses unknown senders?
The SPF check reads whether your mail domain publishes exactly one SPF record that ends by soft failing or refusing senders it does not name. SPF lists the services allowed to send email for your domain.
What does this check look at?
It looks at whether your mail domain publishes one SPF record that ends by refusing or soft failing the senders it does not name. Cloudflare describes an SPF record as a DNS TXT record that lists all the servers authorized to send emails from a particular domain.
Pulse and Deep scans both run it. It reads public records about your domain and never touches your site.
What does a result mean?
| What the report shows | What it means | What to do |
|---|---|---|
| Pass | One record ends in a soft fail or a hard fail. | Nothing here. Check DMARC next. |
| Attention | No SPF record is published. | Publish one that names your real senders. |
| Not tested | The record could not be read, or it ends some other way. | The broken SPF records check says more when it is permissive or broken. |
It does not check that your real senders are listed or that their mail lines up with your domain. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.
How serious is a finding?
Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts at medium, because it rests on public records rather than a response from your site. The report lists what to fix by how directly someone could use it, not by the severity label.
What does a confirmed finding have to show?
| Part | For this check |
|---|---|
| Where it starts | Anyone sending mail or resolving your domain |
| The protection that should stop it | A DNS setting read from public records |
| What is reached | Email and DNS trust decisions |
| What follows | A hardening gap for your domain |
Which standards does it relate to?
| Standard | Reference |
|---|---|
| OWASP Top Ten | A02:2025 Security Misconfiguration |
| CWE | CWE-345 |
Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.
Fix it with your AI
Your email provider and every tool that sends mail as you will tell you what to include.
Help me write one SPF record for my domain. Ask me which services send email as my domain (for example Google Workspace, Microsoft 365, my newsletter tool, my app's transactional email provider), look up the include each one documents, and combine them into a single v=spf1 TXT record that ends in ~all. Keep it under ten DNS lookups and tell me exactly what to paste into my DNS settings.How to check
Say Atlas, our example app at atlas.example, sends mail through a workspace provider and a newsletter tool but publishes no SPF record. The check flags it, and the record above fixes it in one DNS change.
Run a Pulse scan from your Lockpick account to see it for your site. Pulse or Deep explains what each scan reads, and the full list of checks shows the rest.
Questions people ask
Is SPF enough to stop fake email from my domain?
No. SPF checks the hidden sending address, not the From line people see. DMARC ties them together and tells mail servers what to do with failures.
Should my record end in ~all or -all?
Either passes. Most domains start with ~all, a soft fail, and rely on DMARC to quarantine or reject failures.
See what your site shows from outside
A quick check reads your homepage the way a visitor would and gives you a score. No account needed.
Check your siteSources
- Email anyone can send Lockpick docs, read on October 7, 2026
- How we rate findings Lockpick docs, read on October 7, 2026
- What is a DNS SPF record? Cloudflare Learning Center, read on October 7, 2026