IT Toolbox
Guide

How to check a SPF record

Control the FPS published in the DNS of a mail domain.

TopicIT Networking →
⌚ About 2 min read
View my favorites
DNS & Email Intermediate. 5 min

Control the FPS published in the DNS of a mail domain.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Asking TXT records

    Use Resolve-DnsName domain.fr -Type TXT.

  2. 2

    Find SPF Chain

    It normally starts with v=spf1.

  3. 3

    Monitoring mechanisms

    Check the final ~all or -all mechanism for:

  4. 4

    Avoid multiple FPS

    A domain must not publish several separate SPF records.

Commands utiles

Resolve-Dns Name example.fr -Type TXT

À retenir

  • SPF covers the envelope of shipping, not just the visible From field.
  • The limit of DNS SPF searches must be taken into account.
← All les guides
Technical deep dive

SPF: validate envelope policy without exceeding the DNS lookup limit

Technical checkpoints

  • SPF evaluates the MAIL FROM / Return-Path domain, not directly the visible From: header.
  • A domain should publish only one SPF record; multiple TXT records starting with v=spf1 cause PermError.
  • SPF is limited to 10 DNS-triggering lookups caused by include, a, mx, exists or redirect.

Reading an SPF

List every legitimate sending source then count mechanisms that trigger DNS lookups.

v=spf1 include:_spf.provider.tld ip4:203.0.113.10 -all

Topic-specific pitfalls

  • Adding includes without removing old ones can hit the 10-lookup limit.
  • ~all and -all are not equivalent; tightening the ending without an inventory can reject legitimate mail.

How to validate

  • SPF returns pass for every legitimate source and fail for an unauthorized source.
  • The envelope domain used by the provider is confirmed in real message headers.
♡ 0