Find Out Who Can Send Email As Your Company
Check your SPF record and see whether your domain is protecting itself from unauthorized senders.
SPF has a limit. After that, your protection can silently fail while the record still reads correctly.
Who Your Record Lets Send
Allowed to send as you
- Google WorkspaceAllowed
- Your invoicing platformAllowed
- Your email providerAllowed
Everyone else
- An unknown senderBlocked
- Someone forging your addressBlocked
What SPF Is Deciding
Three questions, in order. SPF answers the first two and hands the third to your DMARC policy.
Who can send as you?
Your record lists the services permitted to send using your domain. Anything not on the list is unauthorized.
Does this sender match the list?
The receiving server compares the sending machine against your record and gets a pass or a fail.
What happens when it fails?
The ending of your record decides. A soft fail flags the message and delivers it anyway. A hard fail refuses it.
Reading Your Result
No SPF Record
Nothing says which senders are legitimate.
Your domain publishes no instructions for identifying approved senders, so there is nothing to compare an impostor against.
Ending in ~all
A soft fail. Unauthorized mail is flagged and delivered anyway.
Suspicious mail may be marked, but it is not necessarily blocked.
Ending in -all
A hard fail. Unauthorized mail is refused.
Unauthorized senders fail the SPF check outright. This is the setting that does the work.
Too Many Lookups
Over ten and evaluation stops.
Your record becomes invalid because receiving servers stop evaluating it, and it still reads correctly to the eye.
Where Records Go Wrong
Two Records
A domain must publish exactly one. Two make evaluation fail completely.
Lookup Creep
Each include costs a lookup and may nest further. Adding a CRM can push you past ten.
A Soft Ending
Everything is listed correctly and the record still ends in ~all, so nothing is refused.
Fixing It Without Losing Mail
List Every Service That Sends as You
Mail provider, marketing platform, CRM, invoicing, reminders, support desk. Most businesses find one they forgot.
Confirm There Is Only One Record
This is how a working setup silently breaks when someone adds a service.
Count the Lookups
Ten is a hard limit. Past it the record stops being evaluated while still looking correct.
Then Tighten the Ending
Change ~all to -all only once every legitimate sender is listed.
SPF Protects the Sender, Not Your Name
SPF checks the machine that transmitted the message. It does not check the address your customer actually reads, which is why a message can pass SPF and still appear to come from you.
- SmithDental Office8:47 AMAppointment Reminder · See you Thursday at 2:30.
Hi, our records show your card on file has expired. Please update your payment details before your next visit.
- LabQuest Results9:26 AMYour Results Are Ready · The panel from Monday is available.
- Sending server authorizedYes
- For the sender's own domainYes
- Visible From address checkedNo
- Aligned with what was authenticatedNot by SPF
SPF Alone Does Not Stop Impersonation
DMARC is the record that ties the visible address to what was authenticated. Check your policy next.
We only read public records. We never touch your computers and we never ask for a password.
SPF Is One of Eight
SPF is one category. Blindspot checks the rest of your public exposure.
Common Questions
No. SPF confirms whether a sending server is authorized. DMARC tells receiving servers what to do when authentication fails. Both work together, and without DMARC the SPF result is evidence nobody acts on.
A hard fail is the goal, but only once every legitimate sender is listed. Moving early stops mail from a service you forgot you use, and a customer usually finds that before you do.
No. A domain must publish exactly one. Two cause evaluation to fail entirely, which happens most often when someone adds a service and publishes their own record instead of editing the existing one.
SPF permits ten DNS lookups when a record is evaluated. Past that, receiving servers stop and treat the result as a permanent error. The record still looks correct when you read it, which is why this failure survives for years.
No. This is not a penetration test. It reads public records only, specifically the SPF record published in your domain's DNS, which anyone can look up. Nothing is logged into, no password is tested, and no network is touched.
Your Email Is Only One Door
See what else your public footprint reveals.
We only read public records. We never touch your computers and we never ask for a password.
Keep Reading
Three places this leads next, depending on what you want to do about it.
- Free ToolFind Out If Your Domain Can Be ForgedCheck whether your domain has a DMARC record and whether its policy blocks forged email. Free business-domain result, with no login or network access.
- Free ToolHow to Stop Email SpoofingEmail spoofing is stopped with three DNS records, not with software. Here is what spoofing actually is, why filters cannot catch it, and the exact steps that block someone sending mail as your company.
- ExplainerEmail SpoofingEmail spoofing forges the sender address on a message. Here is how spoofing an email actually works, why the protocol allows it, how to tell a spoofed email, and what stops it.