Truvo Free Tools

SPF record checker

An SPF record is your domain's public list of the servers allowed to send email in its name. This checker reads the record, shows how it ends (hard fail, soft fail or neutral), and names the SOC 2 and ISO 27001 controls the answer affects.

SOC 2 CC6.1SOC 2 CC6.7SOC 2 CC7.2ISO 27001 A.5.14ISO 27001 A.8.20
Ali Aleali

Ali Aleali, CISSP, CCSP

Co-Founder & Principal Consultant

Former security architect for Bank of Canada and Payments Canada. 20+ years building compliance programs for critical infrastructure. These tools come out of that work.

Connect on LinkedIn

How the SPF record checker works

The check is passive: it reads your domain's public TXT records through DNS over HTTPS and looks for the v=spf1 policy, without sending any email.

01

Query

You enter a domain. The tool asks a public DNS over HTTPS resolver for the domain's TXT records and picks out the one that starts with v=spf1. Nothing is sent to your mail servers.

02

Read

The result shows the policy and how it ends: -all (hard fail), ~all (soft fail) or ?all (neutral). A missing record, or a soft or neutral ending, is flagged, because receivers are then told to accept or merely suspect spoofed mail rather than reject it.

03

Map

Each finding names the controls it speaks to: SOC 2 CC6.1, CC6.7 and CC7.2, and ISO 27001:2022 A.5.14 (information transfer) and A.8.20 (networks security). A hard-fail policy is evidence; a missing one is a gap to close.

Found a gap? We fix it for you.

Truvo's security engineers harden mail, DNS and TLS, and hand you the evidence an auditor asks for. Tell us the domain and we will scope the fix.

Contact us

  • SPF hard-fail policy

  • DKIM signing

  • DMARC enforcement

  • Redundant MX hosts

  • Audit evidence

  • Fixed-price scope

SPF checker: frequently asked questions

It reads the TXT record at your domain that begins with v=spf1 and reports what it finds: whether a record exists, which sending services it authorizes, and how it ends. The ending matters most. -all tells receivers to reject mail from unlisted servers, ~all tells them to treat it as suspicious, and ?all expresses no opinion.

Truvo maps SPF findings to SOC 2 CC6.1, CC6.7 and CC7.2, and to ISO 27001:2022 Annex A controls A.5.14 (information transfer) and A.8.20 (networks security). The mapping is advisory: it shows which control a finding gives evidence for or signals a gap against. It is not a substitute for an audit.

Yes. The check queries public DNS over DNS over HTTPS for records your domain already publishes to the whole internet. Nothing connects to your servers and nothing is written or changed. Any mail server that receives a message claiming to be from you performs the same lookup.

Without a record, anyone can put your domain on a phishing email and most receivers will accept it. With a soft-fail ending, receivers are told the mail is suspicious but not to reject it, so spoofed messages often still reach inboxes. The fix is one TXT record that lists every service that legitimately sends mail for you, ending in -all once you have confirmed nothing is missed.

No. SPF says which servers may send as your domain, DKIM signs the messages, and DMARC tells receivers what to do when either check fails and where to send reports. Most domains need all three. The DMARC checker below covers the enforcement side.