Is your SPF record broken or too permissive?

The broken SPF check finds SPF setups that mail servers cannot rely on, such as two records at once, a record that lets any sender pass, or one that needs more DNS lookups than mail servers allow.

What does this check look at?

It looks at whether your SPF setup is duplicated, allows any sender, or needs more DNS lookups than mail servers allow. Others list too many services in SPF and break the limit on lookups, so the record stops working.

Pulse and Deep scans both run it. It reads public records about your domain and never touches your site.

What does a result mean?

It does not check whether your real senders are listed. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

How serious is a finding?

Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts at medium, because it rests on public records rather than a response from your site. The report lists what to fix by how directly someone could use it, not by the severity label.

What does a confirmed finding have to show?

Which standards does it relate to?

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

Fix it with your AI

The usual repair is merging duplicates and removing includes for tools you no longer use.

My SPF record is broken: [paste the evidence from the report]. Read my current SPF TXT records, list every include and what service it belongs to, and ask me which of those services still send mail as my domain. Then write one replacement v=spf1 record that covers only those, stays at or under ten DNS lookups when expanded, and ends in ~all. Tell me which old records to delete.

How to check

Say Atlas, our example app at atlas.example, added a second SPF record for a new newsletter tool instead of editing the first. Mail servers treat two records as an error, and the check names it.

Run a Pulse scan from your Lockpick account to see it for your site. Pulse or Deep explains what each scan reads, and the full list of checks shows the rest.