SPF Record Verification Checklist: Senders, DNS and Message Tests
Verify SPF against the systems that actually send your email. A record copied from a setup article may describe one provider while your contact form, invoices and newsletter use three others. Start with an inventory rather than adding another TXT record whenever a message goes missing.
Make a sender inventory
List your business mailbox provider, website mail service, support platform, invoicing tool and newsletter service. For each, record the sending domain, account owner and the provider’s current authentication instructions. Include services that send only occasionally: a monthly invoice still matters.
Separate inbound mail routing from outbound authentication. MX records route incoming mail; an SPF record describes authorized senders for the relevant domain. Changing one does not complete the other. If your website uses a transactional service, check its return-path setup rather than assuming the visible From address tells you which SPF record is evaluated.
Inspect the existing record
Use your authoritative DNS provider’s record list and a public DNS lookup to compare the published TXT value. Check the exact hostname. A record on the root domain is not a substitute for one required on a sending subdomain. Keep unrelated verification TXT records intact.
Google’s SPF guidance starts with identifying senders and then publishing the matching DNS record. Its example for Google Workspace alone should not be copied as a universal setting. Use the record your actual providers prescribe and have the administrator review any combined configuration.
| Check | Evidence to record | Next decision |
|---|---|---|
| Sender coverage | Each active service and its documented authorization | Resolve missing or retired senders before editing |
| Published DNS | Hostname, current TXT value and lookup time | Confirm you edited the authoritative zone |
| Record validity | Provider validation result and any lookup-limit error | Have the administrator inspect the evaluated configuration |
| Message test | Received headers from each sending service | Check actual SPF results, not just DNS presence |
Test more than one message
Send a controlled message through every active service to a mailbox you own. Keep the timestamp and message identifier, then inspect the recipient’s authentication results. A successful mailbox message does not verify website password resets or automated order receipts.
If forwarding is involved, preserve both the direct-delivery and forwarded results. The route changes what can be observed. Do not treat one forwarded failure as proof that the original sending service is unauthorized. Pair SPF evidence with DKIM verification and DMARC alignment checks.
Change with a recovery record
Export the existing DNS values before an authorized edit. Record who approved the sender list, the new value and a retest time. Evaluate DNS lookup limits with a suitable validator; counting visible include entries alone is not a complete assessment of nested lookups.
Finish when every required service has a documented result or a named unresolved issue. SPF passing does not promise inbox placement. Content, recipient handling and other authentication checks still affect delivery. Use the WordPress email delivery checklist when the application never submits a message.
Example: the mailbox passes, the form sender fails
A hypothetical staff message passes SPF, while a website notification fails. Identify the actual sending route for each message and compare that route with the existing authorization record. A pass for one sender does not cover every service. Preserve the existing record and reconcile the complete sender inventory before adding or removing authorization; then repeat the actual form notification.
Sources and scope
Official documentation checked October 6, 2026: Google Workspace: Set up SPF; Gmail sender guidelines. This is HRL’s general operating checklist, not a test of your domain or a guarantee of delivery, recovery or search visibility.
Related guides
Verify incoming mail routing · Separate website and business email