What is checked?
The check examines the SPF TXT record, its references and DNS lookup budget. SPF uses the MAIL FROM domain; with an empty return path, as used by bounces, the HELO identity becomes relevant. The limit of ten DNS-querying terms includes terms in referenced policies.
Worked example
Synthetic example using a reserved domain and documentation addresses. Adapt the domain, addresses and services to your infrastructure before using it.
example.test. TXT "v=spf1 ip4:192.0.2.10 -all"This single record permits only documentation IP 192.0.2.10. In production, -all is appropriate only once every legitimate outbound sending path has been identified.
Common mistake
Adding another v=spf1 record for each provider causes an error. An MX record alone does not authorize outbound mail through SPF either.
Recommended next step
Inventory public outbound IP addresses and providers. Combine the required mechanisms in one SPF record, remove obsolete includes and recheck the dependent DNS queries.
What the result does not prove
A valid SPF record proves neither successful message authentication nor DMARC alignment. Dynamic macros and the actual SMTP sender require additional context.