What SPF is actually authorizing

SPF (Sender Policy Framework) is a domain owner's published list of which mail servers are authorized to send email claiming to be from that domain — a receiving mail server checks the connecting IP against the domain's SPF record and can reject or flag mail from an IP that isn't listed. This is specifically about the SMTP envelope sender (the technical "MAIL FROM" address), not the visible "From:" header a recipient sees in their inbox — a subtlety that trips people up, since SPF alone doesn't protect against the visible From address being spoofed if the underlying envelope sender is a different, SPF-authorized domain. That gap is part of why DMARC exists on top of SPF and DKIM, tying alignment between the two together.

Why more than one SPF record is a hard failure, not just messy

RFC 7208 explicitly states a domain must have at most one SPF record, and mail receivers that encounter more than one are required to treat that as a permanent error for the domain's SPF evaluation — not "merge them" or "use the first one," but treat SPF as broken entirely for that domain. This usually happens by accident: two different tools or teams each add "the" SPF TXT record without checking whether one already exists, ending up with two separate `v=spf1 ...` TXT records on the same domain. Because the failure mode is silent (mail keeps flowing, just without effective SPF protection) rather than an obvious outage, this is exactly the kind of misconfiguration that can sit undetected for a long time without a tool like this one to check.

Reading the final mechanism

The last mechanism in an SPF record — typically `-all`, `~all`, or `?all` — decides what happens to mail from a sending IP that matched none of the earlier authorized mechanisms. `-all` (hard fail) tells receivers to reject or strongly distrust such mail; `~all` (soft fail) asks receivers to accept it but mark it as suspicious; `?all` (neutral) makes no assertion at all, which is barely different from having no SPF record. A domain serious about protecting its mail reputation generally wants to work toward `-all` once confident every legitimate sending source is properly listed — starting with `~all` during rollout is a common, sensible way to monitor for false positives before committing to a hard fail.