# SPF: check which servers can send for your domain

> Read an SPF result, identify the envelope sender and investigate a failure without guessing which DNS record to change.

By [CheckDMARC](https://checkdmarc.mx/). Published: 2026-11-06. Reviewed: 2026-11-06.

## Start with the envelope sender

SPF checks whether a connecting server is authorized to use an SMTP sending identity. That identity can differ from the From address someone sees in their inbox. A pass for a provider’s domain does not automatically authenticate your visible From domain.

- [Compare SPF, DKIM and DMARC](https://checkdmarc.mx/spf-dkim-dmarc)

## Read the evidence in your report

In CheckDMARC, start with the reported SPF result and envelope-from domain. Compare that domain with the visible From domain, then look at the published SPF record. The receiving server’s result describes the message when it arrived; the DNS shown in a later check may have changed.

What to investigate next
| Result | Next step |
| --- | --- |
| pass | Check whether the authenticated domain aligns with From. |
| fail or softfail | Confirm the actual sending service and IP before changing its authorization. |
| permerror | Inspect record syntax, duplicate SPF records and DNS lookup limits with your provider. |
| none or missing | Check whether the relevant sending domain publishes SPF and whether the original headers are complete. |

- [SPF passes but DMARC fails: a worked example](https://checkdmarc.mx/blog/spf-dkim-pass-dmarc-fail)

## Fix the sending route, then send again

List the services that send your mail: your mailbox, website forms, invoices and newsletters may use different routes. Obtain the exact SPF instructions from each provider. Maintain one SPF policy record for a domain rather than adding a second competing record.

SPF limits DNS-querying mechanisms and modifiers during evaluation; a long chain of includes can cause an error. Adding another include is therefore not a universal fix. Forwarding can also change the connecting server and affect SPF.

1. **Identify one failing route.** Send a new message from that service and record its envelope-from identity.

2. **Confirm the intended configuration.** Use the provider’s current instructions and review the relevant domain’s existing record before editing DNS.

3. **Repeat the same test.** Allow for DNS caching, create a fresh test address and send through the same service again.

- [Run a real email test](https://checkdmarc.mx/#email-check)
- [Follow the testing walkthrough](https://checkdmarc.mx/how-it-works#send-test-email)

## Sources

- [RFC 7208 — Sender Policy Framework, including DNS lookup limits (§4.6.4)](https://www.rfc-editor.org/rfc/rfc7208.html)

## Related reading

- [DKIM: understand the signature on your email](https://checkdmarc.mx/learn/dkim/index.md)

- [DMARC: connect authentication to your From domain](https://checkdmarc.mx/learn/dmarc/index.md)

- [SPF and DKIM pass, but DMARC fails. What now?](https://checkdmarc.mx/blog/spf-dkim-pass-dmarc-fail/index.md)

[Check your email](https://checkdmarc.mx/#email-check)

Web page: https://checkdmarc.mx/learn/spf