SPF IP Tester
Enter a domain and a sending IP address, and SysGlass evaluates the domain's SPF record against that IP exactly as a receiving mail server would (RFC 7208 §4): it returns the SPF result — pass, fail, softfail, neutral, none or permerror — and names the first mechanism that matched (for example ip4:1.2.3.0/24 or include:_spf.google.com) with its qualifier. It walks the whole include:/redirect= chain, so the answer reflects the real record, not just the top line. Use it to confirm a new mail server or sending service is authorized before you go live.
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- The SPF result for the exact IP you enter (pass / fail / softfail / neutral / none / permerror / temperror)
- The first matching mechanism and its qualifier (+, -, ~, ?)
- Whether the IP is covered by ip4:/ip6:, a, mx, include: or redirect= — resolving the full chain
- PermError conditions (over the 10-lookup limit, multiple SPF records) that make receivers treat SPF as failed
- The published SPF record itself
How to read the result
- pass = the IP is authorized to send for the domain; it matched an authorized mechanism.
- fail (-all) = the IP is explicitly NOT authorized; compliant receivers reject or junk the mail.
- softfail (~all) = not authorized, but the domain asks receivers to accept-and-mark rather than reject.
- neutral / none = the record makes no assertion, or there is no SPF record — little protection.
- permerror = the record can't be evaluated (over 10 lookups or multiple records); receivers treat it as a failure — fix the record.
Frequently asked questions
How is this different from the SPF Checker?
The SPF Checker audits the record itself — its existence, the 10-lookup count, and the all-qualifier. The SPF IP Tester answers a specific question: would THIS sending IP pass or fail SPF for this domain? It runs the same receiver-side evaluation a real mail server does and tells you which mechanism matched.
What do I enter?
A domain (the one in the message's Return-Path / envelope-from) and the IP address of the server that would send the mail. SysGlass then reports the SPF result for that IP and the matching mechanism.
Why does a server I expected to pass come back as fail or softfail?
The IP isn't covered by any authorized mechanism in the record's include chain, so evaluation falls through to the terminal all (-all gives fail, ~all gives softfail). Add the sending IP — via ip4:/ip6:, the provider's include:, or a/mx — and re-test.
Does it follow include: and redirect= chains?
Yes. It recursively resolves include: and redirect= just like a receiver, enforcing the RFC 7208 lookup and void-lookup limits, so the result accounts for your whole SPF policy, not only the apex record.
Does this send any email?
No. It only reads DNS and evaluates the SPF record against the IP you provide. No message is sent and no connection is made to your mail server.