How to Check Your Published SPF TXT Record

Find the domain the receiver checked

SPF evaluates the connecting IP against the policy for the SMTP MAIL FROM envelope domain. That identity is not necessarily the same as the visible From:address. In a received message, inspect the trusted receiver's Authentication-Results header forsmtp.mailfrom; that is the domain to query for an ordinary message.

When the envelope path is empty, SPF processing uses the HELO/EHLO identity. The receiver's authentication result or your sending provider's logs can help identify that case.

Query the public TXT answer

In a terminal with dig, substitute the envelope domain found above:

dig +short TXT bounces.brand.example

Look for the TXT policy beginning with v=spf1. Other TXT records may appear for unrelated services. A domain should publish one SPF policy; count separate answers beginning with v=spf1, not the total number of TXT records. Some DNS tools display one long TXT value as multiple quoted chunks.

If you are using a DNS dashboard, compare its record name and value with the public lookup. A policy published at brand.example does not automatically apply to bounces.brand.example.

Inspect include targets

If the policy contains an include: mechanism, query the exact domain named there to see its currently published SPF TXT value. Repeat for nested includes when you are tracing what the receiver can evaluate.

dig +short TXT _spf.provider.example

DNS output shows what is published; it does not establish that the provider is the sender for a particular message. Confirm the sending service and its current published instructions with the provider that handles the mail.

Read the received authentication result

Open the message's original headers and find the result added by the mailbox provider that received it. For example:

Authentication-Results: mx.receiver.example;
  spf=pass smtp.mailfrom=bounces.brand.example;
  dmarc=pass header.from=brand.example

The sample is illustrative. Results may say pass, fail,softfail, neutral, none,permerror, or temperror. SPF and DMARC report different things: SPF evaluates authorization for its envelope identity, while DMARC also requires an SPF or DKIM authenticated domain to align with header.from. Read the receiver's result rather than trusting a similarly named header from an earlier hop.

In Gmail, use the message menu and choose Show original. Other providers offer a “view source” or “message details” option. DMARC aggregate reports can also show recurring sending IPs and authentication outcomes over a reporting period.