SPF and envelope-domain diagnostics
SPF missing on a subdomain? Check the exact MAIL FROM domain
SPF is evaluated at the envelope sender domain used for a message. A valid record on the organizational domain does not automatically apply to a bounce, return-path or custom MAIL FROM subdomain.
Message headers identify a subdomain as the envelope sender, but that exact name has no SPF record.
Return-Path: <[email protected]> Authentication-Results: spf=none smtp.mailfrom=bounce.example.com
Check the MAIL FROM domain free
Why SPF on the parent domain is not enough
Receivers select an SPF policy using the identity under evaluation. If a provider sends with bounce.example.com in MAIL FROM, the receiver looks for SPF at that exact subdomain. The TXT record at example.com is a different policy and is not inherited.
This separation is useful: a transactional platform can have a narrowly scoped authorization without granting the same senders permission for every other subdomain.
What the check does—and does not—prove
When the exact envelope domain is available from your input or safe message-header extraction, MailFixIt queries its public SPF policy and identifies an unconfigured envelope domain. It can also expose ordinary SPF syntax and dependency problems.
DNS alone does not prove which MAIL FROM identity a provider will use on the next message. Confirm it in actual headers or the sending service's custom MAIL FROM settings.
Possible diagnostic results
SPF found on the exact domain
The envelope domain is configured. Review whether the actual sender is authorized and whether DMARC alignment is required.
SPF missing on the subdomain
The parent may have SPF, but the evaluated envelope identity does not. Use the sending provider's verified policy for that subdomain.
SPF invalid or duplicated
The exact name publishes a malformed policy or multiple selected SPF records. Consolidate carefully while preserving legitimate senders.
Envelope domain unknown
A website domain alone cannot reveal it. Supply message headers or the precise custom MAIL FROM setting for a deeper result.
How to configure SPF for a MAIL FROM subdomain
- Read the exact envelope sender from
Return-Pathorsmtp.mailfrominAuthentication-Results. - Confirm which sending service owns that identity and obtain its current SPF instructions.
- Inventory every legitimate sender that uses the same subdomain.
- Publish one SPF policy at the exact subdomain, preserving only required mechanisms.
- Rerun DNS diagnostics and send a controlled test to verify the receiver result.
The provider domain below is fictional. Use your sender's documented value.
Before: bounce.example.com. TXT (no SPF policy) After: bounce.example.com. TXT "v=spf1 include:_spf.sender.example -all"
Rollback by restoring the exported prior TXT values if the subdomain serves another purpose. Do not overwrite unrelated TXT records.
When DNS is probably not the cause
If the receiver reports SPF pass for the exact envelope domain, investigate DKIM and DMARC alignment, forwarding behavior, message reputation or recipient policy. An SPF pass does not guarantee delivery, and a subdomain record cannot repair a provider that sends with a different identity.
Verify the repair
Resolve TXT at the exact MAIL FROM domain and confirm that only one SPF policy is selected. Send a new message through the affected path, then compare smtp.mailfrom and spf=pass in the receiver's headers.
Run the free SPF subdomain check
Related SPF checks
SPF subdomain FAQ
Does the SPF record on my main domain cover its subdomains?
No. SPF evaluation uses the exact envelope sender or HELO identity being checked. A record at example.com is not inherited automatically by bounce.example.com.
Can I copy the root-domain SPF record to the MAIL FROM subdomain?
Only after confirming that the subdomain uses the same legitimate senders. Blindly copying a record can authorize unnecessary sources or preserve obsolete includes.
Technical references
RFC 7208: identities checked by SPF · RFC 7208: selecting records