A verdict needs evidence
Same sender.
Different answers?
Trace dynamic SPF, compare DNS endpoints and measure failures over a bounded test window. Every answer has a source and a timestamp.
Included with a free account
Sign in to collect your DNS evidence
Checking your account… A free account is required to run a check and access its results.
Checks are on demand. Evidence stays available for 20 minutes; download it for your records.
Collecting evidence
Starting diagnostic
Slow or unreachable endpoints consume the same bounded budget. Stopping keeps the samples already collected.
Point-in-time evidence
Trace the exact lookup
SPF TEMPERROR evidence
Each cause is linked to the SPF evaluation and the observed DNS attempts. Successful TCP fallback is not a TEMPERROR.
Measured, with a source
DNS failure evidence
Actual UDP/TCP requests during evaluation and sampling. Negative answers are counted separately. Delegation discovery appears in the timeline. Select a highlighted failure count to see its exact errors.
Failure timestamps and endpoints
Dynamic policy detected
Proofpoint Hosted SPF diagnostics
The sender IP expands into a child DNS name. This identifies the policy provider; it does not attribute a failure to that provider.
RFC 7208 evaluation
SPF outcomes and full trace
SPF PASS, FAIL and TEMPERROR describe different outcomes. SMTP acceptance or rejection is a separate receiver policy.
Follow the delegation
Authoritative endpoints
Nameservers sharing an IP are grouped together. Multiple NS names do not establish independent physical servers.
What was actually observed
Interpretation
Every request · UTC
DNS evidence timeline
| UTC / round | Endpoint | Query | Result | Evidence |
|---|
Scope of this evidence
Evidence expires from this server's memory after 20 minutes and is lost on a service restart. Download the report for your support ticket. This tool does not schedule or retain ongoing monitoring.