Updated · Volt Ghost team
How the records end
| Final mechanism | Meaning for a receiver | Listed domains |
|---|---|---|
-all | Fail mail from any server not listed | 2,664 (69%) |
~all | Soft fail: accept but mark as suspicious | 1,107 |
?all | Neutral: no statement | 50 |
+all | Pass mail from any server on the internet | 12 |
redirect= | Use another domain's record | 19 |
No all at the end | Unlisted servers get a neutral result | 5 |
Strict endings dominate. 355 domains publish nothing but v=spf1 -all, which authorises no sender at all; 143 of them still have a working MX record, so they receive mail while stating that they never send any. At the other extreme, 12 domains end in +all, which lets any machine on the internet pass SPF as that domain. All 12 run their own mail. host.
Records that authorise nothing real
A large share of "strict" records name a sender that cannot exist on the public internet. That is a cheap way to look configured while sending nothing.
| Pattern | Domains | Who uses it |
|---|---|---|
ip6:fd36:7c64:44d0::/48 -all and similar fd ranges | 447 | All 341 domains on the Wabbly/Wally mail hosts; 56 Above.com parking names use a different fd range |
ip4:1.1.1.1 -all | 131 | 114 from one temp-mail.org batch (22 May 2025) |
ip4:1.0.0.1 -all | 88 | Every domain on mail.tm's in.mail.tm server |
Addresses starting with fd are IPv6 unique local addresses (RFC 4193), private ranges that are never routed on the internet. 1.1.1.1 and 1.0.0.1 are Cloudflare's public DNS resolver, not a mail server. A receiver following these records will fail every message from the domain, so in practice they behave like v=spf1 -all. The mail.tm server page shows the rest of that service's setup, and the Above.com parking page covers the parked names.
Whose servers they include
| Included record | Service | Listed domains |
|---|---|---|
spf.protection.outlook.com | Microsoft 365 (Exchange Online) | 588 |
_spf.mx.cloudflare.net | Cloudflare Email Routing | 325 |
_spf.google.com | Google Workspace | 161 |
mailgun.org | Mailgun | 54 |
sendgrid.net | SendGrid | 53 |
spf.efwd.registrar-servers.com | Namecheap email forwarding | 41 |
amazonses.com | Amazon SES | 17 |
The Microsoft 365 count is almost entirely one batch: 566 of the 654 domains added from throwaway.io on 12 October 2026 (see October 2026) carry the same include:spf.protection.outlook.com record, while their MX points at a mail. host on each domain. The Cloudflare includes match the Cloudflare Email Routing group almost one for one. Real providers look different: compare Proton Mail's records, where SPF and DMARC are written around the servers that actually send its mail.
By mail server
| Mail server group | Domains with MX | With SPF |
|---|---|---|
| Wabbly/Wally hosts | 341 | 341 (100%) |
mail.casadorock.com | 256 | 256 (100%) |
| erinn.biz / beavis99 hosts | 172 | 172 (100%) |
| mail.tm | 88 | 88 (100%) |
| Cloudflare Email Routing | 317 | 309 (97%) |
| GPTMail | 1,025 | 52 (5%) |
| generator.email | 319 | 30 (9%) |
| Tinyhost | 303 | 8 (3%) |
| TEMPMAIL.TW | 282 | 1 (0%) |
smtp.oneb.net | 137 | 0 (0%) |
SPF is a per-operator habit, not a per-domain one. Some services publish the same record on every name they run; others, including the large GPTMail and generator.email pools (see the GPTMail page), leave almost all of their domains without one. Every domain on mail.casadorock.com publishes v=spf1 mx -all, allowing only its own mail server.
Broken records
18 listed domains publish two or more TXT records starting with v=spf1; one has seven. RFC 7208 section 4.5 says a receiver must return a permanent error in that case, so none of those records counts. 5 records have no final all at all. Our SPF, DKIM and DMARC checker flags both problems for any single domain.
What SPF tells you about a sign-up
Very little. SPF is checked when a domain sends; a temp inbox only has to receive a verification code, and SPF plays no part in that. A disposable domain with a perfect record is still disposable, and a real company domain with no record is still real. To decide whether an address is throwaway, check the domain itself. Related: DMARC on disposable domains and MTA-STS on disposable domains.
Check one domain
Enter one address or domain to see whether it is on the disposable list, or pick MX records to see where its mail goes. One name per query; we do not publish the list.
Questions
Do disposable email domains have SPF records?
About half do. On 9 November 2026, 3,857 of the 7,966 listed domains that still exist in DNS published SPF, including 3,615 of the 6,723 with a working MX record.
Does an SPF record mean a domain is not disposable?
No. SPF only describes who may send mail for a domain. Temp mail services, parked names and real providers all publish it, so it says nothing about whether an inbox is throwaway. Use a disposable domain list or lookup for that.
What does v=spf1 -all mean?
It authorises no server at all and asks receivers to fail anything claiming to come from the domain. 355 listed domains publish exactly that record, the standard way to say a domain sends no mail.
Why would a domain publish more than one SPF record?
Usually by mistake, after adding a provider without removing the old record. RFC 7208 treats two or more SPF records as a permanent error, so the domain effectively has no valid SPF. 18 listed domains were in that state on 9 November 2026.
