What Is an SPF Policy Tester?
An SPF policy tester is a tool that checks a domain's SPF record for errors and confirms whether a specific IP address is authorized to send email on that domain's behalf.
IT administrators use it to confirm that a new server or third-party platform is correctly authorized. Email and marketing teams use it to troubleshoot delivery issues tied to sender authentication.
How an SPF Record Works
An SPF record is a DNS TXT record listing the IP addresses allowed to send email for a domain. When an email arrives, the receiving server checks the sending IP address against that list.
| Host | Type | Value |
|---|---|---|
@ | TXT | v=spf1 ip4:192.168.0.1 -all |
v=spf1 identifies the version. ip4 specifies an authorized address. -all instructs receiving servers to reject email from any address not listed.
If the sending IP address matches an entry in the record, the message passes the SPF check. If it doesn't, the message can fail authentication, and receiving servers may send it to Spam or reject it.
Why SPF Validation Matters
An incomplete or outdated SPF record creates two risks. Authorized senders can be left out, causing legitimate email to bounce or land in Spam. Or the record can be too permissive, letting an unauthorized source pass the check.
SPF is also finite. A record can trigger no more than 10 DNS lookups. Records that exceed this limit fail validation entirely, regardless of which senders are listed correctly.
For organizations managing multiple business units, marketing platforms, and cloud services, SPF errors accumulate quickly.
SPF confirms whether a sending server is authorized. On its own, it doesn't stop unauthenticated email from reaching an inbox. That level of control comes from DMARC, which uses SPF and DKIM results to instruct receiving servers on how to handle emails that fail authentication.
Common SPF Misconfigurations
- Missing senders. A new platform or server was added without updating the SPF record.
- Exceeded lookup limit. The record triggers more than 10 DNS lookups, which invalidates it.
- Multiple SPF records. More than one SPF TXT record is published for the domain.
What Sendmarc's SPF Policy Tester Shows You
Enter a domain and IP address, and the tool returns a breakdown across the following:
- SPF record presence. The tool retrieves the domain's published SPF record from DNS and checks that it's active.
- Senders and mechanisms. The tool lists the senders and mechanisms published in the domain's SPF record and confirms whether the specific IP address entered is among them.
How to Use Sendmarc's SPF Policy Tester
- Enter your domain. Type the domain name you want to check.
- Enter the IP address. Add the IP address of the sending server you want to validate.
- Select Check SPF record. The tool queries the domain's DNS and retrieves the current SPF record.
- Review the result. Check the record's validity, authorized senders, and mechanisms used.
- Act on it. Update the record to add missing senders or remove overly permissive mechanisms.
Run an SPF check whenever you add a new sender or investigate a delivery issue.