How to Check That a Domain's SPF Record Includes Its Mail Provider

To check that SPF matches the mail provider, read the MX records to see who hosts the mailboxes, then look in the SPF record for that provider's include. The bulk MX and SPF match checker compares them for up to 100 domains a run, 500 after a free Google sign-in. Each row names the provider behind the first MX host and whether the top-level SPF record includes it. DNS only; no mail is sent.

Why compare them

The MX records say who receives a domain's mail, and the SPF record says who may send it. They are separate, but when staff mailboxes are at Google Workspace or Microsoft 365 they usually send through the same provider too, and SPF needs its include (include:_spf.google.com or include:spf.protection.outlook.com) or that mail can fail SPF. RFC 7208 defines how includes are evaluated. This finds domains where a provider was moved or added without the SPF record being updated.

Doing it by hand

dig +short MX example.com
dig +short TXT example.com

The first shows the provider from the MX host names, for example Google or Outlook hosts. The second shows the SPF record, the TXT value that starts v=spf1. Check that the matching include is in it. Repeat for every domain.

Step 1: paste the domains

Paste domains, email addresses or URLs, one per line, up to 100 a run or 500 after a free Google sign-in.

Step 2: run the check

Each domain's MX and TXT records are read over DNS, 10 domains a request. The provider is recognised from the first MX host with the same table as the bulk email provider lookup.

Step 3: read each row

Result	What it means	What to do
SPF names the MX provider	The include is in the top-level record	Nothing to fix
SPF doesn't name it	The provider's include is missing	Check whether the domain sends through that provider
Provider not covered	Not one of the three providers compared	Nothing compared
No SPF record	No v=spf1 TXT record	Publish one if the domain sends mail
More than one SPF record	Two or more v=spf1 records	Merge into one
No MX	No MX records	Nothing to compare
Lookup failed	DNS did not answer properly	Try again later

Mismatch versus a real problem

A mismatch means the top-level SPF record has no include for the provider the first MX host belongs to. It is a prompt to look, not a fault. It is fine if the mailboxes only receive and the domain sends through a different service, or if the include sits inside another record this check does not expand.

Two cases are always worth fixing: more than one SPF record, which fails SPF with a permanent error (RFC 7208 section 4.5), and no SPF record on a domain that sends mail. To merge several services into one record, see combining services in one SPF record, and for the lookup limit, SPF too many DNS lookups. To count the lookups of each record, use the bulk SPF lookup counter.

What this check cannot do

• Only the top-level SPF record is read; nested includes are not expanded.
• Only three mailbox providers are compared. Domains behind a security gateway or forwarder, where the mailbox host is not visible, show as Provider not covered.
• Only the first MX host is used to find the provider.
• The limit is 100 domains a run without an account and 500 signed in.

Check the addresses you send to

Correct DNS gets mail to the door; the address still has to exist. Upload your list on the verify page: the first 100 email checks are free with a Google sign-in, no card. Each address comes back valid, risky or invalid with a reason, and nothing is sent to anyone on the list. For larger or recurring lists, see bulk email verification, list cleaning and pricing.

Check your domains now

Paste them into the bulk MX and SPF match checker.