SPF Investigator

What this tool checks

When a domain's SPF record fails for a specific sender, it's rarely obvious why from the raw record alone — the failure could come from an unauthorized IP, a missing include, a lookup that timed out, or a mechanism buried three includes deep. This tool resolves a domain's full SPF chain, walks every mechanism, and checks whether the IP you provide matches any of them, then shows exactly which mechanism (if any) authorized it and where it came from.

How to use the result

If the IP is authorized, the matching mechanism and its source are highlighted in the trace below — useful for confirming a new sending service was added correctly. If it isn't authorized, read the recommendation: it usually points to a missing include: for a third-party sender, a rotated IP range that fell out of date, or a mail server sending outside your documented infrastructure entirely.

Common mistakes

• Assuming SPF failure means DMARC failure. DMARC passes on SPF or DKIM alignment — a message can still authenticate on DKIM alone.
• Investigating the wrong IP. Use the connecting IP from the mail server logs or DMARC aggregate report, not the address a marketing tool shows in its dashboard, which is often a load balancer, not the sending host.
• Checking once and assuming it's permanent — sending IP ranges for third-party providers do change.