What is SPF?
SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send mail for a domain. Receivers compare the connecting IP address with that list and return pass, fail, softfail or neutral. It checks the envelope sender (the Return-Path), which can differ from the From address people see. RFC 7208 defines it.
Reading the result
The verdict comes first, then a meter of DNS lookups against the limit of 10, with the cost of each term so you can see which are expensive. The policy line reads the all term at the end: -all is enforcing, ~all is soft and ?all is neutral. If our two resolvers disagree, the answer is marked untrusted instead of guessed.
Beat runs on the same engine, on a schedule, across all 41 checks and 25 blacklists. What it adds is asking again, noticing when an answer changes and telling you what to do about it.
Common SPF record problems
More than 10 DNS lookups
Every include, a, mx, ptr and exists term costs a lookup, and so does redirect. Nested includes count too. Past 10, RFC 7208 makes the result permerror and SPF stops passing for all of your mail.
Two SPF records
A domain may publish only one record starting with v=spf1. With two, receivers return permerror and use neither. Merge them into one.
A record ending in +all
+all gives a pass to every IP address on the internet, so anyone can pass SPF as you.
A sender left out
If a service you send through (a CRM, a helpdesk, a billing tool) is missing from the record, its mail fails SPF. Compare the includes with every tool that sends as your domain.