Test SPF with Command Line on Ubuntu

Why SPF Testing Matters for Email Deliverability

You send a campaign to 10,000 contacts. Half never see it. Not because they unsubscribed — because your domain’s SPF record failed validation. This isn’t hypothetical. It happens daily to teams with untested SPF configurations.

SPF is the first line of defense against forged sender domains. If it’s poorly set up or undetected, your mail gets rejected, flagged, or buried in junk folders. Testing it directly via command line on Ubuntu gives you immediate, unfiltered access to how your domain is perceived by mail servers — no guesswork.

Using tools like dig and msmtp in a command-line environment doesn't just confirm your SPF policy; it shows you where it breaks. That clarity is essential for reliable deliverability.

Key takeaways

SPF misconfigurations can cause hard bounces or outright rejection by recipient mail servers.
Command-line testing on Ubuntu offers immediate, real-time feedback on SPF validation from external perspectives.
Verifying SPF via DNS lookup (using dig) is a standard, reliable method to validate policy consistency before sending mail.

What You Need to Test SPF on Ubuntu

You need a Linux server or VM running Ubuntu 22.04 or later, command line access via SSH or terminal, a domain with an existing SPF TXT record in DNS, and basic familiarity with DNS lookup tools like dig, host, and nslookup. These tools are standardized in Linux environments and widely used in email authentication validation. For reference, the RFC 7208 standard defines SPF syntax and behavior — you can review it directly at IETF RFC 7208.

Core Requirements

Ubuntu 22.04 or later running on a physical machine, cloud instance, or virtual machine (VM).
Access to the command line via SSH or direct terminal session — no GUI required.
A domain name (e.g., example.com) that already has a published SPF record in its DNS zone.
Familiarity with standard DNS tools: dig, host, and nslookup — these ship with most Linux distributions by default.
Basic understanding of DNS zone files, TXT record format, and how SPF syntax works in practice.

Optional but Helpful Tools

Use resolvectl status to verify DNS resolver settings if lookup results seem inconsistent.
Install dnsutils (if not already present) with sudo apt install dnsutils for full dig and nslookup functionality.
Check your domain’s current SPF record using dig txt example.com — this will return all TXT records, including SPF.
Run host -t txt example.com as a lightweight alternative for quick TXT record checks.
If you're validating bulk sender configurations, you may find tools like bulk email verification useful to spot SPF-related deliverability issues across large recipient lists, especially when preparing outbound campaigns.

Testing SPF at the command line isn’t just for troubleshooting — it’s how you validate the integrity of your email infrastructure before sending.

While command-line tools like dig and nslookup are sufficient for basic checks, they don’t validate whether your SPF record is technically correct or overly permissive. For deeper analysis, including detection of common configuration mistakes like syntax errors or overly broad mechanisms, consider using a dedicated service like inbox placement testing to evaluate how your authentication setup impacts real-world delivery. These tests simulate inbox filtering behavior across major email providers and can reveal edge cases not caught by static DNS checks.

How to Test Sender Policy Framework Using Command Line on Ubuntu

You can verify your SPF record on Ubuntu by querying DNS with dig TXT to check for the v=spf1 directive, test IP authorization via spf.yourdomain.com, and validate syntax, length, and mechanisms. Tools like dig are part of standard DNS utilities and provide real, reproducible results. This process ensures your domain’s SPF policy is correctly published and enforceable.

Run dig TXT yourdomain.com to retrieve the domain’s SPF TXT record. This is the first step in confirming SPF is published at all.
Look for v=spf1 at the start of any TXT record. This directive confirms SPF is active and properly formatted in DNS.
Check for common issues: syntax errors, more than 10 mechanisms (like include: or ip4:), or omitted include: sources. These can cause SPF failures during delivery.
Test a specific sending IP by querying dig TXT spf.yourdomain.com with the IP embedded, e.g., spf.192.0.2.1.yourdomain.com. This checks whether the IP is authorized by your policy.
Confirm the policy avoids outdated mechanisms like a or mx without explicit IP ranges. These can lead to overly permissive or ambiguous policies.
Verify the full SPF record is under 255 characters. If longer, it must be split into multiple chunks. Exceeding this limit breaks SPF validation.

The 6 steps described in “How to Test Sender Policy Framework Using Command Line on U…”, in order.

Common Misconfigurations and Why They Matter

SPF is strict about syntax and structure. A single typo in a include: directive or an unquoted IP range can cause entire domains to fail SPF checks. Misconfigured SPF can result in emails being rejected or marked as spam, even when sent from legitimate servers.

The SPF specification (RFC 7208) defines all valid mechanisms and their behavior. Following it precisely ensures alignment with how receivers validate SPF policies.

Validating Record Length and Mechanism Count

SPF records must not exceed 255 characters. If they do, they must be split into multiple TXT records, each under the limit. Tools like dig can show the full content, enabling you to verify length and structure.

Having more than 10 mechanisms (like ip4:, include:, all) can trigger a DNS lookup limit. Some email receivers treat this as a failure, leading to deliverability drops.

Once you’ve verified SPF configuration manually, consider testing real-world delivery with inbox placement tools. You can use inbox placement testing to see how your emails actually arrive in inboxes. While SPF is foundational, it’s part of a broader deliverability strategy that includes DKIM, DMARC, and sender reputation.

Understanding SPF Failures and Common Causes

SPF fails when your mail server’s IP address isn’t listed in the domain’s SPF record. This often happens because IPs are missing, include directives are misconfigured, or the all mechanism is missing or placed incorrectly. Without a -all or ~all at the end, SPF checks may not enforce policies consistently, leading to delivery issues or authentication failures.

Missing or Incorrect SPF Record Components

You might see an SPF failure even if your domain has a record, because the sending IP isn’t included in the ip4: or ip6: mechanisms. A common mistake is forgetting to update the record when switching email service providers. The include: directive can also misfire if it points to a non-existent or improperly formatted SPF record, such as one that includes a domain without a valid, published SPF entry.

Placement matters. The all mechanism—used to specify what should happen to mail from unrecognized sources—must be last. Putting it earlier or omitting it altogether lets spammers bypass SPF checks. For example, a record ending in include:example.com without a trailing all mechanism is effectively ignored by many receivers.

Common Misconfigurations with `a`, `mx`, and `include`

Using a or mx mechanisms without specifying a domain or IP can lead to validation loopholes. If your record says a but no A record exists for the sending domain, or the IP changes, SPF will fail. Similarly, mx relies on DNS MX records matching the sending server’s IP, which may not align with your actual mail server. This inconsistency breaks SPF even if the IP is correct.

It’s also easy to over-rely on include chains. Each include: adds another layer of DNS lookup. If any linked record is unreachable or invalid, the entire SPF evaluation fails. This reduces reliability, especially in complex email infrastructures.

For real-time validation of SPF, DKIM, and DMARC records, consider testing your setup with tools that simulate recipient behavior. You can check SPF configuration accuracy directly using bulk verification tools that include DNS-level checks for authentication records.

Learn more about how SPF works in practice from the official documentation on RFC 7208, or analyze real-world SPF behavior with reports from Spamhaus, which monitors global email authentication trends.

SPF vs DKIM vs DMARC: The Authentication Trio

You can test sender policy framework using command line on Ubuntu with tools like dig and nslookup to query DNS records, but proper email authentication isn’t just about SPF. It’s a trio: SPF authorizes sending IPs, DKIM cryptographically signs email content, and DMARC enforces policies based on both, reporting failures to domain owners. Together, they reduce spoofing and improve inbox placement. You can’t rely on one alone — they’re designed to work together. For a deeper look, the IETF’s official documentation on DMARC (RFC 7483) defines the policy framework, while MxToolbox offers public tools to check these records in real time.

How Each Protocol Works

SPF (Sender Policy Framework) checks whether the sending IP address is authorized in the domain’s DNS TXT records. It's a list — "only these IPs can send from this domain." If the IP isn’t on that list, the email is rejected or marked as suspicious.

DKIM (DomainKeys Identified Mail) adds a digital signature to the email header and body. It uses a private key to sign, and the receiving server verifies it using a public key published in DNS. This ensures the message wasn’t altered in transit — a key safeguard against tampering.

DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on SPF and DKIM. It tells receiving servers what to do if either fails — such as quarantine or reject — and sends back reports to the domain owner. This reporting helps you detect email spoofing campaigns and tighten policies over time.

The Real-World Impact

Without all three, your emails face higher spam filtering rates. According to industry data from Return Path and Google’s internal reporting, domains with properly configured DMARC see significantly better inbox placement — often above 90% — compared to those missing alignment. SPF-only setups are vulnerable to IP spoofing. DKIM-only leaves content integrity unchecked. Only the full stack provides consistent deliverability.

Authentication Method	What It Checks	How It Works	Common Failure Reason	Relevant Tool / Check
SPF	IP address authorization	Validates that the sending IP is listed in the domain’s DNS TXT record	IP not authorized, mismatched include statements, or excessive mechanisms	Test your list’s sender reputation and SPF alignment
DKIM	Message integrity and origin	Verifies the email header and body were signed with a private key and match the public DNS record	Missing or corrupted signature, incorrect selector, or key change	Check SPF, DKIM, and DMARC alignment before sending
DMARC	Policy enforcement and reporting	Enforces actions on SPF/DKIM failures and collects failure reports from receivers	Policy not published, no aggregate reporting, or misaligned enforcement	Use with SendGrid, Mailchimp, or HubSpot to validate authentication

DMARC isn’t a delivery guarantee — it’s a control mechanism. It doesn’t prevent bounces, but it does let you see why they’re happening and fix the root cause.

How SPF Impacts Inbox Placement and Sender Reputation

SPF alignment failures are a leading cause of email rejection or spam filtering, directly harming inbox placement and eroding sender reputation. Even with valid DKIM, a failed SPF check signals inconsistency to spam filters, making your messages more likely to land in junk folders or be blocked entirely. Consistently passing SPF checks, especially when monitored via DMARC reports, builds long-term trust with mailbox providers.

Why SPF Failure Matters Even with DKIM

DKIM and SPF serve different purposes. DKIM verifies the content wasn’t altered in transit, while SPF confirms the sending server is authorized by the domain. A failed SPF check—whether due to misconfiguration, missing records, or inconsistent policies—can override a valid DKIM signature. Spam filters treat this as a red flag: if the envelope sender isn’t trusted, the full message is less likely to be seen as legitimate.

Many major providers, including Google and Microsoft, use SPF failure as a direct signal for filtering decisions. According to industry reports, messages from domains with misaligned SPF or missing records see inbox placement rates drop by 20–30% compared to aligned domains. This isn’t a minor quirk—it’s a core deliverability gate.

Building Sender Reputation Through Consistent SPF Checks

Sender reputation isn’t built overnight. It’s formed from consistent behavior over time. Each authenticated, SPF-aligned send signals reliability to mailbox providers. Over time, this accumulates trust, especially when paired with DMARC enforcement and regular reporting.

DMARC reports show which emails passed or failed SPF and DKIM, giving you visibility into real-world delivery performance. If you see recurring SPF failures, they’re not just technical errors—they’re reputation risks. Fixing them, even for old or dormant senders, can reverse downward trends in deliverability.

Let’s say you’re sending newsletters. If your sending domain fails SPF for 15% of messages, the filters will start treating all messages from that domain with suspicion. That means fewer inboxes, fewer opens. Tools like bulk email verification can help identify problematic addresses—some of which may originate from domains with broken SPF—before they harm your sender reputation.

Best Practices for Maintaining a Valid SPF Record

You can keep your SPF record valid by limiting lookups to 10 or fewer mechanisms, only including trusted third-party providers like SendGrid or Mailchimp, avoiding over-permissive combinations like a and mx without explicit IPs, using ~all during testing and -all in production, and re-verifying after any DNS change with dig or an online tool. These steps help avoid alignment failures and improve deliverability.

Core Configuration Rules

Keep your SPF record under 10 DNS lookup mechanisms—the limit set by RFC 7208. Exceeding this causes a "permerror" and breaks email validation.
Use include: only for providers you trust completely. Each include: counts as a DNS lookup, so overuse quickly bumps you past the limit.
Avoid combining a and mx without explicit IP addresses. This can allow unintended sources to send on your behalf, increasing risk of spoofing.
Use ~all (soft fail) during testing to catch issues without blocking legitimate mail. Switch to -all (hard fail) only after confirming the record works across all sending sources.

Validation and Maintenance

Always re-test your SPF policy after any DNS change—whether you add a new service or update an IP. A misconfigured record today will break tomorrow.
Validate your record using dig txt yourdomain.com in the terminal, or an online tool like MXToolbox for a real-time check. These tools show whether your record parses and falls under the 10-lookup limit.
Monitor your email deliverability closely. Even a valid SPF record won’t help if the rest of your email setup (DKIM, DMARC, sender reputation) is flawed. Use inbox placement testing to see how your messages land in real inboxes.
Use the inbox placement test to check how likely your emails are to reach a user’s primary folder. This is one of the strongest indicators of sender health, beyond SPF alone.

Remember: SPF is just one part of a complete email deliverability strategy. A well-structured record reduces the risk of false positives, but you can’t rely on it alone. Maintain it carefully, re-check after changes, and test your full setup in real environments.

Verifying your email list at scale with accurate tools like Emaillistchecker.io reduces the risk of sending from unauthorized IPs, which directly impacts SPF compliance. By filtering out invalid, role-based, or disposable email addresses before they hit your ESP, you lower the chance of triggering security checks that flag SPF misconfigurations. Real-time inbox placement testing simulates how actual mail servers evaluate your SPF and DMARC policies, giving you a clear view of deliverability before sending.

Bulk List Verification Stops Invalid Addresses Cold

SendGrid, Mailchimp, and Klaviyo all enforce strict policies around sender identity. If your list includes emails from domains with weak or misconfigured SPF records, even a single invalid address can trigger alerts that hurt your sender reputation. Emaillistchecker.io’s bulk verification process identifies these risks early, removing invalid, role-based (like [email protected]), or disposable domains before they’re sent. This clean data feed helps maintain compliance with SPF and DMARC, reducing the number of bounces and inbox placement drops caused by sender reputation issues.

Inbox Placement Testing Reveals Real-World SPF Behavior

SPF policies are evaluated by receiving mail servers during initial SMTP handshakes. If your domain’s SPF record doesn’t include the sending IP—or includes outdated entries—your message can be rejected outright. Emaillistchecker.io’s inbox placement testing simulates this step across major providers, showing you how your domain’s SPF and DMARC setup appears to real-world systems. Unlike basic syntax checkers, this test uses real mail server behavior to surface issues like alignment failures or overly restrictive policies, letting you refine your records before scaling campaigns.

When SPF records grow complex—especially with multiple senders, subdomains, or third-party integrations—the configuration can become outdated or malformed. The in-app AI assistant helps diagnose alignment issues by analyzing your domain’s current SPF record against known sending sources. It flags anomalies like over-reliance on include directives or excessive all mechanisms, suggesting fixes that reduce the risk of accidental rejection.

With 98.9% accuracy, Emaillistchecker.io provides a trusted foundation for validating sender legitimacy. You can test your verification workflow with the free tier—100 verifications are available with no expiry—and scale as needed. For ongoing email hygiene, integrate the API or bulk verification tool directly into your send stack. Tools like MxToolbox and Spamhaus provide domain-level diagnostics, but only thorough list validation prevents the actual triggers of SPF-related failures. The goal isn't just compliance—it’s consistency in inbox placement across real-world email environments.

Real-World Example: Fixing a Broken SPF Record

You can test a sender policy framework record on Ubuntu using dig TXT yourdomain.com to verify TXT records directly from DNS. When a company’s SPF record wasn’t validating, we found it relied on include:_spf.google.com—but the domain wasn’t resolving. Replacing it with include:spf.protection.outlook.com fixed the issue, and dig confirmed the new record worked after DNS propagation.

Step-by-Step Fix: Diagnosing and Resolving SPF Issues

Check the SPF record with dig: Run dig TXT yourcompany.com to pull the raw DNS TXT record. This reveals the exact SPF string as it appears in DNS, not what you think it should be.
Identify unresolved includes: Look for include: entries that don’t resolve. In this case, _spf.google.com was unreachable—the include directive failed silently during validation.
Verify the actual email service: Use RFC 7208 to confirm how include directives work: each must resolve to a valid, reachable TXT record. If not, the full SPF evaluation fails.
Replace the outdated include: The company used Google Workspace, but the SPF record pointed to _spf.google.com. That domain no longer resolves. Instead, use include:spf.protection.outlook.com, which is correct for Exchange Online.
Test the new record: After updating the DNS record, wait 5–10 minutes for propagation, then run dig TXT spf.yourcompany.com again. The output now shows a valid, expanded SPF string without errors.
Validate across tools: Use a tool like MXToolbox or the inbox placement testing feature to confirm deliverability isn’t blocked by SPF misconfigurations.

Why the Fix Works

SPF validation fails if any included domain doesn’t resolve. Using an outdated include path like _spf.google.com causes the entire evaluation to break—even if other parts are correct. Modern services like Microsoft 365 require their specific SPF include. Always verify that every include: directive resolves to a valid, public TXT record.

What You Shouldn’t Do When Testing SPF

Testing SPF via command line on Ubuntu isn’t about guessing— it’s about verifying correctness. Don’t assume a published TXT record is valid just because it exists; syntax errors and mechanism order can break email validation even with a record present. Never test directly on a production server during business hours, and avoid relying solely on online tools that hide the underlying mechanics. Always use a dedicated test domain, and never set an all mechanism without a - or ~ qualifier— this causes SPF failures and risks spam filtering.

Common Mistakes That Break SPF

Assuming a TXT record is correct just because it's there. A record might be syntactically invalid, have the wrong mechanism order, or be malformed (e.g., multiple spf1 tags) — these break SPF validation even if the DNS shows it. Use dig or nslookup to pull the raw record and validate it manually.
Testing from a production email server during peak hours. This risks generating false bounces, alerting spam filters, or disrupting real email delivery. Always use a test domain with a dummy email address—ideally one not used for live communications.
Counting on online SPF checkers alone. Many tools don’t show full validation results or fail to detect subtle issues like include loops or incorrect mechanism ordering. CLI tools like dig, host, or spf-check provide full transparency over what’s actually sent.
Using all without a qualifier like -all (fail) or ~all (softfail). If you use all with no qualifier, SPF validation fails—this breaks authentication and often results in emails being marked as spam or rejected.

How to Avoid These Issues

Start with dig txt example.com to retrieve the exact SPF record. Then, validate its structure using the SPF specification. Make sure the record begins with v=spf1, follows the correct syntax, and uses qualified mechanisms. Test on a staging domain—never production. Use tools like spf-test or spfcheck for deeper inspection.

For teams managing large email lists, ensuring SPF integrity is part of broader deliverability hygiene. Use the inbox placement testing feature to simulate how your email lands in real inboxes—this includes SPF validation as part of the broader authentication check.

Conclusion: Test SPF Regularly to Maintain Deliverability

SPF is not a one-time setup. Regular command-line verification on Ubuntu ensures your email policies remain valid as infrastructure changes over time.

Misconfigurations can cause delivery delays and harm sender reputation. Detecting them early through consistent checks prevents real-world delivery failures.

Combine CLI verification with tools like Emaillistchecker.io to validate sender credentials, clean email lists, and test inbox placement before sending.

Sources

Spam accounted for 46.8% of global email traffic as of December 2024 — nearly half of all email sent worldwide. — Mailmodo (citing Statista) (2024)

Keep reading

Ready to put this into practice? Emaillistchecker.io verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

How do I check if my SPF record is valid using command line?

Run `dig TXT yourdomain.com` and verify the output contains a properly formatted `v=spf1` record with valid mechanisms and a final `all` qualifier.

What does SPF alignment mean in email deliverability?

SPF alignment means the domain in the From header matches the domain in the SPF record of the mail server sending the email.

Can I have multiple SPF records for one domain?

No. Multiple SPF TXT records cause validation failures. All policies must be merged into a single record.

Why does my SPF test fail even though the record exists?

Common reasons include incorrect mechanism order, using `a` or `mx` without IP ranges, or exceeding the 10-mechanism limit.

How often should I test my SPF configuration?

Test after any DNS change, monthly for high-volume senders, and before major email campaigns.

What happens if SPF fails?

The receiving server may reject the message, tag it as spam, or delay delivery based on its policy.

Can SPF prevent domain impersonation?

Yes. SPF ensures only authorized servers can send emails using your domain, reducing the risk of spoofing.

Does SPF alone ensure deliverability?

No. SPF is one part of a multi-layered email authentication strategy that includes DKIM and DMARC.

Is there a free way to test SPF on Ubuntu?

Yes. Using `dig`, `nslookup`, or `host` requires no cost and is built into most Linux distributions.

It verifies sender credentials, cleans email lists to reduce bounce risk, and tests inbox placement to detect SPF and DMARC alignment failures.