Validate SPF Records

Overview

SPF Validator reads the TXT records at `domain`, after stripping any scheme and leading `www.`, and keeps those starting with `v=spf1`. It then follows every `include:` and `redirect=` target breadth-first. Each domain is queried once, and the walk stops after 50 domains. `dns_lookups_num` is the number of domains queried along the way, not the RFC 7208 count of every `a`, `mx`, `ptr` and `exists` term.

Each record in `spf_records_list` carries its `origin`, the `record` text, `chars_num`, `use_macro` (true when a term contains `%{`), the `domains` it includes and the `authorized_ips` it lists. Only `ip4` and `ip6` terms with a pass qualifier count as authorized; `-ip4`, `~ip4` and `?ip4` are skipped. `authorized_ips` and `domains_extracted` combine them across the whole chain. `spf_record` is the root domain's record.

When you send `ip`, `ip_pass` is true if the address falls inside any authorized range, matched by address family and prefix length, or if it matches the A, AAAA or MX hosts named by `a` and `mx` terms (up to 10 such terms). An address that is not a valid IP returns `false`; without `ip`, the field is null.

`all_qualifier` reads the `all` term in the root record: `fail` for `-all`, `softfail` for `~all`, `neutral` for `?all`, `pass` for `+all` or a bare `all`, and null when there is none. `risk_score` is 70 with no record, 80 for `pass`, 50 for `neutral` or no `all`, 25 for `softfail` and 5 for `fail`, raised to at least 60 when more than 10 domains were queried. `spf_valid` means a record was found. A DNS failure on the root domain returns a 503. Results are cached for 15 minutes per domain and IP pair.

Live Test Validate SPF Records Source →

Formula

One function covers the whole catalog: the first argument names the source, the next are its inputs, and the field after them says which single value lands in the cell. Formulas covers the grammar that applies to all of them.

=VERVE("spfvalidator", A2, "host")

=VERVE.CALL("spfvalidator", A2, "host")

A2 holds the domain you are looking up. Drag the formula down and each row resolves on its own.

With literal values

Nothing has to come from a cell — typed values work the same way.

=VERVE("spfvalidator", "myspace.com", "host")

=VERVE.CALL("spfvalidator", "myspace.com", "host")

Inputs

Required inputs are positional, in the order below, followed by the field. Everything else is passed as a "name", value pair after that — the same shape as SUMIFS. Premium inputs are accepted on every plan but only take effect on plans that include them.

What lands in your sheet

The field — the argument after the inputs — is what makes the formula resolve to one cell. Its value is a dot-path from the table below, so swapping it is how you pull a different value — one formula per column.

Seeing everything at once

Leave the field out and the formula returns the whole response instead: two columns, field name on the left and value on the right, spilling from the cell you typed in.

=VERVE("spfvalidator", A2)

=VERVE.CALL("spfvalidator", A2)

Response fields

Paths are relative to data. Each one is exactly what the field argument accepts, so swapping it is how you pull a different value into a cell. On a plan without a Premium field the cell reads #PREMIUM(field) rather than a value, so a locked field never looks like a real answer.

Filling a whole column

Both platforms make one batched call for a column rather than one request per cell, and both cost the same — 10 credits per row looked up. How you write it differs, because the two runtimes batch at different points.

=VERVE("spfvalidator", A2:A100, "host")

In Google Sheets, give the arguments ranges and the answers spill down from the cell you typed in. Custom functions there run synchronously and in isolation, so dragged cells cannot be coalesced — the range form is how a column becomes one call. The field is required here: a per-row two-column table has nowhere to spill. Use a full column per input (A2:A100, not A2) — a single-cell reference is read as row 1 only and the rest of the column comes back blank.

In Excel, type the formula once and fill down — no range form and none needed, because its runtime is asynchronous and the add-in coalesces the calls a fill produces into a single batched request. Do not hand VERVE.CALL a range: Excel flattens it into positional arguments, so A2:A100 arrives as a hundred separate arguments and the cell reads #ERR rather than filling.

Either way, column A holds your domain values and the answers land beside them, one row each, blank rows skipped.

When a cell doesn't fill

A failed lookup returns readable text starting with #ERR rather than a spreadsheet error, because Excel cannot show a custom message on a real error — you would get a bare #VALUE! with no reason. The trade-off is that IFERROR() will not catch it; test with LEFT(cell, 4) = "#ERR" instead. Error handling covers the rest.

Before the formula works

The add-in reads the API key you saved once in the side panel — the key never goes in the formula, so a shared sheet does not leak it and a collaborator without access simply sees the last calculated values.

1. Install the add-in for Google Sheets or Excel.
2. Open the side panel and sign in, or paste a key from your dashboard.
3. Type the formula above into any cell.

Use cases

Outbound Mail Onboarding

Before sending campaign blasts, marketing platforms check customer sender domains to confirm a valid SPF record exists and inspect the all-mechanism qualifier.

Mail Gateway Threat Screening

When incoming messages arrive, mail security gateways test the relay IP against the sender domain's SPF record to flag unauthorized server relays.

DNS Configuration Auditing

Flag syntax errors and missing SPF records across managed domains so IT administrators fix broken mail authentication settings before delivery rates drop.

Sales Outreach Health Checks

Sales engagement tools query sending IP authorization across connected mailboxes to prevent cold outreach from landing in recipient spam folders.

Other ways to use Validate SPF Records

Set up Validate SPF Records on VerveSheets, or reach the same source a different way. Your VerveSheets account and credits work on all of them — one key, one balance.

Related

More in Domain Data: