---
title: "SPF Record Verification Using dig, nslookup, and PowerShell Explained | AutoSPF"
description: "Verify SPF records using dig, nslookup, and PowerShell. Learn how to check SPF syntax, troubleshoot errors, and improve email authentication."
image: "https://autospf.com/og/blog/spf-record-verification-using-dig-nslookup-and-powershell-explained.png"
canonical: "https://autospf.com/blog/spf-record-verification-using-dig-nslookup-and-powershell-explained/"
---

Quick Answer

You can verify an SPF record by querying the domain's TXT record using dig, nslookup, or PowerShell (Resolve-DnsName). These tools confirm whether your SPF record is valid, properly configured, and helping protect against email spoofing.

## Try Our Free SPF Checker

Instantly analyze any domain's SPF record - check syntax, count DNS lookups, and flag errors.

[ Check SPF Record → ](/tools/spf-checker/) 

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fspf-record-verification-using-dig-nslookup-and-powershell-explained%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=SPF%20Record%20Verification%20Using%20dig%2C%20nslookup%2C%20and%20PowerShell%20Explained&url=https%3A%2F%2Fautospf.com%2Fblog%2Fspf-record-verification-using-dig-nslookup-and-powershell-explained%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fspf-record-verification-using-dig-nslookup-and-powershell-explained%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fspf-record-verification-using-dig-nslookup-and-powershell-explained%2F&title=SPF%20Record%20Verification%20Using%20dig%2C%20nslookup%2C%20and%20PowerShell%20Explained "Share on Reddit") [ ](mailto:?subject=SPF%20Record%20Verification%20Using%20dig%2C%20nslookup%2C%20and%20PowerShell%20Explained&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fspf-record-verification-using-dig-nslookup-and-powershell-explained%2F "Share via Email") 

![SPF record verification process](https://media.mailhop.org/autospf/spf-permerror-1054-1784110485674.jpg) 

## What SPF Records Are and Why Verification Matters

An SPF record is a DNS TXT record that identifies which mail server, host, or third-party platform is authorized to send email for a domain. SPF stands for [Sender Policy Framework](https://autospf.com/blog/spf-guide-understanding-sender-policy-framework/), an internet standard used for email authentication and **spoofing prevention**. When a receiving email server gets a message, it performs a DNS lookup against the sender’s domain to determine whether the sending IP address is permitted by the published SPF policy.

A typical SPF record looks like this:

```
v=spf1 include:_spf.google.com include:spf.protection.outlook.com mx -all
```

This [TXT record](https://www.digicert.com/blog/what-is-a-txt-record) tells receiving systems that Google Apps, Microsoft, and the domain’s MX record hosts may send mail. _The final qualifier, such as `-all`, `~all`, or `?all`, defines the sender policy for everything else._ **Correct spf syntax** is critical because even a small syntax error can affect mail delivery.

**SPF validation** matters because it helps protect a domain name from forged email address usage. Without a valid SPF record, attackers may impersonate a mail sender from your domain, increasing phishing risk and damaging sender reputation. For sysadmin teams, verifying the SPF record should be part of routine [DNS records](https://www.ibm.com/think/topics/dns-records) management, especially after changing an email server, adding a subdomain, or connecting services such as GitHub notifications, Google Workspace, Microsoft 365, [CRM systems](https://gedys.com/en/cxm-and-crm-wiki/what-is-a-crm-system), or marketing platforms.

An SPF check confirms that the correct TXT record exists, that **DNS resolution works**, and that the SPF policy does not exceed lookup limits. Y_ou can perform an spf record lookup using DNS tools such as the dig command, nslookup, PowerShell, an SPF lookup tool, or an online spf check tool such as AutoSPF._

## How to Check an SPF Record with dig

The dig command is one of the most reliable command line utilities for querying DNS. It is commonly available on [Linux and Unix systems](https://en.wikipedia.org/wiki/List%5Fof%5FUnix%5Fsystems) and can also be installed on Windows through packages such as **BIND tools**, Git Bash, or WSL. Because dig communicates directly using the DNS protocol, it provides precise visibility into the DNS query, response, TTL, record type, and authoritative data.

To check an SPF record with the dig command, query the TXT record for the domain:

```
dig TXT example.com
```

Because SPF is published as a TXT record, the query type should be TXT, not SPF. Older DNS implementations once supported an **SPF DNS resource record**, but modern SPF configuration relies on TXT. The output will usually include an answer section similar to this:

```
example.com. 3600 IN TXT "v=spf1 include:_spf.google.com mx -all"
```

This dig output shows the domain, TTL, class, record type, and **TXT record value**. If the SPF record is missing, the DNS query may return no answer, [NXDOMAIN](https://www.cloudns.net/blog/what-is-nxdomain/), or only unrelated TXT values such as site verification tokens.![Kitterman Spf 5944](https://media.mailhop.org/alumniforwarding/kitterman-spf-5944-1784112353444.jpg)

### Useful dig command examples

For a concise SPF check, use `+short`:

```
dig TXT example.com +short
```

This [dig command](https://www.whoisxmlapi.com/blog/dig-command) returns only the TXT record strings, making the output easier to scan from the command line. If the domain has multiple TXT records, look for the one beginning with `v=spf1`.

To query a specific DNS server, such as Google Public DNS or OpenDNS, use:

```
dig @8.8.8.8 TXT example.com +short
dig @208.67.222.222 TXT example.com +short
```

This helps determine whether a DNS server has stale data or whether public DNS has already resolved the latest SPF record. A sysadmin may also use the **dig utility** to test a subdomain:

```
dig TXT mail.example.com +short
```

The query string here combines the hostname and query type. If you are troubleshooting mail delivery from a specific host or email server, checking both the **root domain and relevant subdomain** can reveal mismatched SPF configuration.

## Verifying SPF Records Using nslookup

nslookup is another widely available [DNS lookup](https://threat.media/definition/what-is-a-dns-lookup/) tool included with Windows, Linux, and Unix environments. While the dig command is often preferred by DNS administrators for detailed diagnostics, nslookup remains useful because it is installed by default on many **Windows systems** and can quickly verify a TXT record from the [command line](https://www.dpconline.org/handbook/tool-demos/command-line-intro).

To perform an SPF record lookup with nslookup, run:

```
nslookup -type=TXT example.com
```

The response should include one or more TXT entries. The SPF record will start with `v=spf1`. For example:

```
example.com text = "v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all"
```

If the output shows no SPF record, verify that you queried the correct domain name. Many organizations publish SPF only at the **organizational domain**, while others publish SPF for a subdomain used by an application, newsletter platform, or [transactional mail](https://www.uspsdelivers.com/the-powerful-marketing-potential-of-transactional-mail/) server.

### Interactive nslookup mode

You can also use nslookup interactively:

```
nslookup
set type=TXT
example.com
```

To query a specific DNS resolver, such as Google or OpenDNS: \`

```
nslookup
server 8.8.8.8
set type=TXT
example.com
```

![Spf Record Check 4622](https://media.mailhop.org/alumniforwarding/spf-record-check-4622-1784112279498.jpg)This approach is useful when **comparing internal DNS server** results against Public DNS. If an internal DNS resolver returns different spf results from public DNS, the issue may involve split-horizon DNS, caching, propagation delay, or an incorrect [zone file](https://www.ninjaone.com/it-hub/it-service-management/what-is-a-zone-file/).

A common mistake is using the wrong record type. SPF data must be retrieved as a TXT record. Querying an [MX record](https://www.cloudns.net/wiki/article/12/) is useful for identifying inbound [mail server](https://www.cloudflare.com/learning/email-security/what-is-a-mail-server/) destinations, but it does not directly show the SPF policy. However, the SPF record may contain the **`mx` spf mechanism**, which authorizes the hosts listed in the domain’s MX record to send mail.

## Checking SPF Records in PowerShell

**PowerShell provides a native way** to perform DNS lookup operations on Windows. This is especially useful for Microsoft administrators managing Exchange Online, Microsoft 365, hybrid email authentication, or [Windows Server DNS](https://petri.com/configure-dns-server-on-windows/).

The primary command is `Resolve-DnsName`:

```
Resolve-DnsName -Name example.com -Type TXT
```

This command line query returns TXT record data, including SPF if present. The relevant output may appear in the `Strings` field:

```
Name : example.com
Type : TXT
Strings : {v=spf1 include:spf.protection.outlook.com -all}
```

PowerShell is often easier to script than nslookup, making it practical for bulk [SPF validation](https://autospf.com/blog/spf-validation-tools-the-best-online-checkers-for-your-domain/) across **multiple domains**. For example:

```
$domains = "example.com","example.org","mail.example.net"

foreach ($domain in $domains) {
Resolve-DnsName Name $domain Type TXT |
Where-Object { $_.Strings -match "v=spf1" } |
Select-Object Name, Type, Strings
}
```

### PowerShell checks for specific DNS resolvers

To query a specific DNS server with PowerShell, use the `-Server` parameter:

```
Resolve-DnsName -Name example.com -Type TXT -Server 8.8.8.8
```

![Kitterman Spf 9229](https://media.mailhop.org/alumniforwarding/kitterman-spf-9229-1784112408042.jpg)This spf query is helpful when comparing local DNS resolution with **Google Public DNS**. If your DNS server returns an old TXT record while Google returns the updated SPF record, the difference may be caused by [TTL caching](https://www.cloudns.net/wiki/article/188/) or delayed zone propagation.

For automation, [PowerShell](https://www.igmguru.com/blog/what-is-powershell) can also check whether a domain has more than one SPF record. Multiple SPF records are invalid and can cause SPF validation to fail:

```
$txt = Resolve-DnsName -Name example.com -Type TXT
$spf = $txt | Where-Object { $_.Strings -match "^v=spf1" }
$spf.Count
```

A result greater than one indicates a configuration problem. _The fix is not to publish separate SPF records, but to merge all authorized services into a single SPF record._

## Interpreting Results and Troubleshooting Common SPF Issues

Reading the SPF record correctly is just as important as running the [DNS query](https://www.cloudns.net/wiki/article/254/). A valid SPF record starts with `v=spf1` and contains one or more mechanisms such as `ip4`, `ip6`, `include`, `a`, `mx`, or `exists`. It usually ends with an **enforcement qualifier** such as `-all`, `~all`, or `?all`.

### Common SPF interpretation points

The `include` mechanism authorizes another domain’s SPF policy. For example, `include:_spf.google.com` allows Google’s designated **mail server infrastructure** to send mail. The `mx` mechanism authorizes hosts listed in the MX record. The `a` mechanism authorizes the IP address of the domain’s hostname. The `ip4` and `ip6` mechanisms authorize explicit address ranges.

An **SPF record using** `-all` tells the receiving mail server to reject unauthorized senders. A record using `~all` produces a soft fail, often accepted but marked suspicious. A record using `?all` is neutral and provides weak spoofing prevention.![Spf Flatterning 1107](https://media.mailhop.org/alumniforwarding/spf-flatterning-1107-1784112070625.jpg)

#### Frequent causes of SPF failure

One common issue is publishing multiple SPF records. DNS allows multiple TXT records, but **SPF permits** only one SPF record per domain. If two TXT records both begin with `v=spf1`, authenticating mail can fail.

Another common problem is exceeding the SPF DNS lookup limit. _SPF allows a maximum of 10 DNS lookups caused by mechanisms such as `include`, `a`, `mx`, `ptr`, and `exists`._ Too many **third-party senders** can break SPF validation. In that case, simplify the SPF policy, remove unused services, or flatten carefully while monitoring changes.

[Syntax errors](https://en.wikipedia.org/wiki/Syntax%5Ferror) are also frequent. Missing spaces, invalid mechanisms, malformed CIDR ranges, and incorrect quotation can prevent a mail server from interpreting the SPF record. Communities such as Stack Overflow and **stackoverflow.com** discussions may help explain command line behavior, but DNS and email authentication decisions should be verified against authoritative documentation and actual DNS query results.

Finally, remember that **SPF checks** the envelope sender domain, not always the visible From header. This means SPF alone is not complete email authentication. For stronger protection, pair SPF with [DKIM](https://autospf.com/blog/how-dkim-works-a-comprehensive-guide-to-email-authentication/) and DMARC. _A selector is more commonly associated with DKIM, but all three controls work together to improve domain protection, mail delivery reliability, and trust in the sending email server._

While `dig`, `nslookup`, and **PowerShell are excellent tools** for manually verifying SPF records, ongoing SPF management becomes more challenging as organizations add cloud email services. [AutoSPF](https://autospf.com/) continuously validates SPF records, detects configuration issues, prevents lookup limit errors, and helps keep your email authentication accurate without manual DNS maintenance.

![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) 

[ Brad Slavin ](/authors/brad-slavin/) 

General Manager

Founder and General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base.

[LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) 

## Ready to get started?

Try AutoSPF free — no credit card required.

[ Book a Demo ](/book-a-demo/) 

## Related Articles

[  Intermediate 6m  10 Reasons Why DIY-ing SPF isn’t a Good Choice for Companies  Apr 4, 2024 ](/blog/10-reasons-diy-ing-spf-isnt-good-choice-for-companies/)[  Intermediate 5m  The 12.4 billion shield for your email communications: Why DMARC software is the unsung hero in the war against phishing actors!  Nov 19, 2025 ](/blog/12-4-billion-dmarc-software-shield-protecting-email-from-phishing-actors/)[  Intermediate 3m  3 points to consider before setting your SPF record to -all (HardFail)  May 22, 2025 ](/blog/3-points-to-consider-before-setting-your-spf-record-hardfail/)[  Intermediate 3m  5 key contributors to the development of the Sender Policy Framework  Nov 12, 2024 ](/blog/5-key-contributors-to-sender-policy-framework-development/)

```json
{"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"SPF Record Verification Using dig, nslookup, and PowerShell Explained","description":"Verify SPF records using dig, nslookup, and PowerShell. Learn how to check SPF syntax, troubleshoot errors, and improve email authentication.","url":"https://autospf.com/blog/spf-record-verification-using-dig-nslookup-and-powershell-explained/","datePublished":"2026-07-15T00:00:00.000Z","dateModified":"2026-07-15T00:00:00.000Z","dateCreated":"2026-07-15T00:00:00.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/spf-record-verification-using-dig-nslookup-and-powershell-explained/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/spf-permerror-1054-1784110485674.jpg","caption":"SPF record verification process"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://autospf.com/intermediate/"},{"@type":"ListItem","position":4,"name":"SPF Record Verification Using dig, nslookup, and PowerShell Explained","item":"https://autospf.com/blog/spf-record-verification-using-dig-nslookup-and-powershell-explained/"}]}
```