SPF publishes a domain’s sender authorization policy in DNS. It is one part of email authentication and needs to match the actual sending services.
The following checks provide related public observations. Their presence does not mean this entire topic has been tested or that the application is secure.
Reads the domain's SPF record and checks that it ends with ~all or -all.
Publish one SPF record that lists your mail providers and ends with ~all (or -all once DMARC reports look clean), e.g. v=spf1 include:_spf.google.com ~all.
A blocked or unfinished check remains unverified. Review technical recommendations with the person operating the website and test changes before applying them to a live service.
Read the full methodology