SPF Health Dashboard

← Back to landing

How healthy is the SPF deployment of the Tranco top-1M? This dashboard inspects every v=spf1 record we observed, then breaks them down by enforcement strictness (-all / ~all / …), static DNS-dependent terms and the RFC 7208 limit, the mechanism mix (modern includes vs legacy IP ranges) and record length. The final cross-tab shows which ESPs nudge their customers toward strict SPF.

628,913domains publishing SPF

—using -all (strict)

—using ~all (soft fail)

—≥11 top-level terms · requires evaluation

—+all (dangerous)

2026-09-13scan date · 664,797 MX domains

1. Enforcement strictness — `all` qualifier

RFC 7208 §5.1 default qualifier is +. Best practice is -all (hard fail) or ~all (soft fail). +all accepts any sender — operationally equivalent to publishing no SPF at all and is trivially abusable.

2. Static DNS-dependent terms · evaluation limit is 10

Counts top-level lookup mechanisms (include, redirect, a, mx, exists, ptr). Nested dependencies are not evaluated. This is not a count of executed DNS requests: early matches and nested evaluation change the path. Available headroom and PermErr prevalence are not confirmed. Evaluate the full chain with the actual sending IP before drawing a delivery conclusion.

3. Mechanism mix

includes-only: outsourced sending (the modern, easy-to-update pattern). ip-only: legacy hand-curated IP ranges. mixed: combination. passthrough: +all with no real mechanisms — accepts everyone.

4. Record length distribution

A single TXT chunk is limited to 255 bytes — longer records are sent as multiple chunks concatenated. Records over ~450 bytes are at risk of resolver fragmentation issues.

Percentile	Bytes

4b. By Tranco tier

Two static observations by list position: +all ("accept mail from anyone on my behalf") and SPF records that contain more than 10 top-level DNS-dependent terms. Neither the nested dependencies nor the path for a particular sender were evaluated. These counts are review candidates, not measured SPF failures.

Tier	Domains with SPF	+all	?all	-all	>10 top-level terms

5. ESP × strictness cross-tab (top 30 ESPs)

For each top ESP, the share of customer SPF records that use each all qualifier. Higher -all share suggests the ESP nudges customers toward strict SPF; higher ~all share is the typical conservative default.

ESP	Customers	-all	~all	?all	+all	no-all

Source: OpenINTEL forward-DNS Tranco snapshot (2026-09-13). Parser: parsers/spf_health.py. ESP join uses dictionaries/esps.py. Lookup-counting is intentionally non-recursive — these are static terms, not a measured PermErr rate. Nested dependencies and headroom are unknown.