Bulk MX and SPF match checker: does the SPF record name the mail provider?
In short: Paste domains and see the mailbox provider behind each one's MX records compared with the includes in its SPF record, with multiple or missing SPF records flagged. Limit: Only the top-level SPF record is read; nested includes aren't expanded.
A bulk MX and SPF match checker compares where a domain's mail is hosted with who its SPF record authorises. Paste up to 100 domains, or 500 after a free Google sign-in, and each row names the mailbox provider behind the first MX host (Google Workspace, Microsoft 365 or Zoho Mail) and whether the top-level SPF record includes it. DNS only. Download the CSV.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. Check your list free nowSee pricing
Sample result
globex.example's mail is at Microsoft 365 but its SPF record doesn't include it; acme.example's names Google Workspace.
- Domain
- globex.example
- MX provider
- Microsoft 365
- SPF includes
- mailer.example
What this means for you
That is fine if the provider doesn't send as the domain, and worth fixing if it does.
- Provider read from the first MX host
- Google, Microsoft and Zoho includes
- Missing or doubled SPF flagged
- Top-level record only; CSV out
- MX
- SPF
- Provider
By SimpleVerifier Team · Last updated
Auditing the email DNS of a domain list?
- Paste the domains here: up to 100 a run, or 500 after a free Google sign-in. Filter to the rows that need a fix and download the CSV.
- Upload or paste it at /verify. Every address gets a live mailbox check, and the first 100 email checks are free with a Google sign-in, no card.
How do I compare the MX provider and SPF record of many domains?
- Paste domains, email addresses or URLs, one per line, up to 100 a run or 500 after a free Google sign-in.
- Press Compare MX and SPF. Each domain's MX records and TXT records are read over DNS, 10 domains a request. No mail is sent.
- Read each row: SPF names the MX provider, SPF doesn't name it, Provider not covered, No SPF record, More than one SPF record, No MX, or Lookup failed.
- Filter to the mismatches and the missing or doubled SPF records, then download the CSV.
Example
- You enter
- Three domains:
acme.example(MX at Google Workspace, SPF includes it),globex.example(MX at Microsoft 365, SPF doesn't) andinitech.example(two SPF records). - You get
- acme.example: SPF names the MX provider. globex.example: SPF doesn't name the MX provider, with the note on when that is fine. initech.example: More than one SPF record, which fails SPF until merged. Download the CSV.
- Limits
- Up to 100 a run without an account and 500 when signed in with Google, counted over a minute. 10 domains a request; DNS only, the top-level SPF record.
Why compare the MX provider with SPF?
The MX records say who receives a domain's mail, and the SPF record says who may send it. They are separate, but when a domain's staff mailboxes are at Google Workspace or Microsoft 365 they usually send through the same provider, and SPF needs its include (include:_spf.google.com or include:spf.protection.outlook.com) or that mail can fail SPF. RFC 7208 defines how the include mechanism is evaluated.
This is a quick way to find domains where a provider was moved or added without the SPF record being updated.
What counts as a mismatch, and when is it fine?
A mismatch means the top-level SPF record has no include for the provider the first MX host belongs to. It is a prompt to look, not a fault. It is fine if the mailboxes only receive and the domain sends through a different service, or if the provider's include sits inside another record this check doesn't expand.
Two cases are always worth fixing: more than one SPF record, which fails SPF with a permanent error (RFC 7208 section 4.5), and no SPF record at all on a domain that sends mail. To count the DNS lookups of each record, use the bulk SPF lookup counter.
Which providers does it recognise?
It recognises the mailbox provider from the first MX host using the same table as the bulk email provider lookup, and compares only the three providers whose SPF include it knows: Google Workspace, Microsoft 365 and Zoho Mail. Other providers, and domains behind a security gateway or forwarder where the mailbox host isn't visible, show as Provider not covered with nothing compared.
To combine several services into one record without hitting the lookup limit, see how to combine services in one SPF record.
Who uses this tool, and for what?
- Email administrators
- Find domains whose SPF record wasn't updated after a mail migration.
- MSPs
- Audit client domains for a provider the SPF record doesn't know about.
- Deliverability consultants
- Add an MX against SPF column to a domain audit and export it as CSV.
- Agencies
- Check a client's domains before launching a campaign from their own mailboxes.
What can’t this tool tell you?
- Only the top-level SPF record is read; nested includes aren't expanded.
- Three mailbox providers are compared: Google Workspace, Microsoft 365 and Zoho Mail.
- Only the first MX host is used to find the provider.
- Up to 100 domains a run without an account, 500 signed in.
Common questions
- How do I check that SPF matches my mail provider?
- Paste the domains into a bulk MX and SPF match checker like this one. It finds the provider behind each MX and checks the SPF record for its include, with a CSV of the results.
- Is this bulk MX and SPF match checker free?
- Yes. It is a free tool: up to 100 domains a run with no account, and up to 500 a run when you sign in with Google, with no card.
- Is a mismatch an error?
- Not always. It means the top-level SPF record doesn't name the provider that hosts the mail. That is fine if that provider doesn't send as the domain.
- Does it follow nested includes?
- No. It reads the top-level SPF record only, so a provider named inside another include shows as not named.
- Why do I see Provider not covered?
- The first MX host isn't Google Workspace, Microsoft 365 or Zoho Mail, or it is a gateway or forwarder that hides the mailbox host.
- Does it send an email to test SPF?
- No. It reads DNS only.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.