Demo
Demo

Knowledge base

PMTA knowledge base›Command§ 6.3.4

check spf

Check whether a message will pass the SPF check
The same verdict, but without consequences

The command performs the SPF check the same way the recipient will: by the sending address, the name the node introduces itself with, and the return address of the message.

If the return address is given, it is checked; if not, the greeting name is checked. This matches how the check itself works: it has two possible identities, and the receiver takes the first available.

It changes nothing. Neither messages nor the configuration — it only prints the verdict. That is why it is used before enabling check-spf-outbound, not after.

The main trap is checking the wrong address. The check is done against the address the node sends from, not the node’s address in general. If there are several sending addresses or messages go through a proxy, each has to be checked — their verdicts may differ.
What the Hub does. It does not call it. A candidate for adding to the node check: the Hub knows all sending addresses and could run this command against them when deploying the configuration.
Example configuration
# sending address, greeting name, return address
pmta check spf 203.0.113.10 mail.example.com sender@example.com
# without a return address the greeting name is checked
pmta check spf 203.0.113.10 mail.example.com
The third argument is optional, and whether it is present decides which identity is checked — the same fork as in the check itself.
yellow — — directive names, blue — blocks. They are highlighted the same way in the text of the card.
▲

Common mistakes and problems

what people get wrong and how it ends2 mistakes▶

Checking one address out of several

our experience

What it costsThe verdict applies to the address that was named. The other sending addresses may not be listed in the SPF record, and their mail will fail the check at the recipient.
How to spot itThe manual check passes, but some messages are still not accepted.
How to do it rightRun the command for each sending address.

Treating a missing record as success

our experience

What it costsFor a domain without an SPF record the verdict is none, and that is not the same as pass. Receivers treat such a message more strictly, and with outbound checking enabled it will not go out at all.
How to spot itThe command reports no error, yet messages bounce.
How to do it rightPublish an SPF record and list all sending addresses in it.
Compatibility
PowerMTA 6.0
described in the manual of this version · platform: any
The vendor does not state the first version for every directive — there is no note here. The name also appears in the 5.0 edition of the manual.
⇄

Related entries

2 relations

Replaced by

Sender-ID check — a deprecated commandA neighboring check: that one parses the return address, this one checks it against the SPF record. § 6.3.3

Works together with

Resolve a name and connectThe SPF check relies on DNS queries; that command shows what the node’s resolver returns. inference

Referenced from

Do not send what will fail the check at the receiverThe same check by hand — before enabling and without the risk of bouncing mail. § 10.2

How to check on the node
Querying the record directly helps make sure the check is possible at all:
dig +short TXT example.com | grep -i spf
The absence of an SPF record for the domain means the verdict none, not pass: there is nothing to check. The Hub does not call this command.
◇

What else to read

3 articles

◇The activation key is a prerequisite for installation, not a step after itWithout an activation key from SparkPost support the engine neither installs nor runs, and the license tier sets the outbound connection ceiling: on Standard everything above 200 is ignored.◇Cloud restrictionsClouds restrict outbound mail on port 25 until you ask them to lift the limit, and mailbox providers treat their address ranges with suspicion.◇How to turn a sending plan into hardwareTwo constants for sizing any node: about 2 KB of memory per queued recipient and spool space proportional to the total size of the messages.

In the Hub
Cost of a mistake
safe: a wrong value breaks nothing
Scenarios
Message signing and authentication · Prepare a node for sending