MailFixIt

SPF and envelope-domain diagnostics

SPF is not configured for the envelope sender domain

SPF is evaluated at the envelope sender domain used for a message. A valid record on the organizational domain does not automatically apply to a bounce, return-path or custom MAIL FROM subdomain.

Problem description

Message headers identify a subdomain as the envelope sender, but that exact name has no SPF record.

Return-Path: 
Authentication-Results: spf=none smtp.mailfrom=bounce.example.com

Run this automated test on my domain

Enter your domain. MailFixIt checks the relevant DNS records automatically and shows the evidence.

Why SPF on the parent domain is not enough

Receivers select an SPF policy using the identity under evaluation. If a provider sends with bounce.example.com in MAIL FROM, the receiver looks for SPF at that exact subdomain. The TXT record at example.com is a different policy and is not inherited.

This separation is useful: a transactional platform can have a narrowly scoped authorization without granting the same senders permission for every other subdomain.

What the check does and does not prove

When the exact envelope domain is available from your input or safe message-header extraction, MailFixIt queries its public SPF policy and identifies an unconfigured envelope domain. It can also expose ordinary SPF syntax and dependency problems.

DNS alone does not prove which MAIL FROM identity a provider will use on the next message. Confirm it in actual headers or the sending service's custom MAIL FROM settings.

Possible diagnostic results

SPF found on the exact domain

The envelope domain is configured. Review whether the actual sender is authorized and whether DMARC alignment is required.

SPF missing on the subdomain

The parent may have SPF, but the evaluated envelope identity does not. Use the sending provider's verified policy for that subdomain.

SPF invalid or duplicated

The exact name publishes a malformed policy or multiple selected SPF records. Consolidate carefully while preserving legitimate senders.

Envelope domain unknown

A website domain alone cannot reveal it. Supply message headers or the precise custom MAIL FROM setting for a deeper result.

How to configure SPF for a MAIL FROM subdomain

  1. Read the exact envelope sender from Return-Path or smtp.mailfrom in Authentication-Results.
  2. Confirm which sending service owns that identity and obtain its current SPF instructions.
  3. Inventory every legitimate sender that uses the same subdomain.
  4. Publish one SPF policy at the exact subdomain, preserving only required mechanisms.
  5. Rerun DNS diagnostics and send a controlled test to verify the receiver result.
Illustrative DNS change

The provider domain below is fictional. Use your sender's documented value.

Before: bounce.example.com.  TXT  (no SPF policy)
After:  bounce.example.com.  TXT  "v=spf1 include:_spf.sender.example -all"

Rollback by restoring the exported prior TXT values if the subdomain serves another purpose. Do not overwrite unrelated TXT records.

Verify the repair

Resolve TXT at the exact MAIL FROM domain and confirm that only one SPF policy is selected. Send a new message through the affected path, then compare smtp.mailfrom and spf=pass in the receiver's headers.

Frequently asked questions

Does the SPF record on my main domain cover its subdomains?

No. SPF evaluation uses the exact envelope sender or HELO identity being checked. A record at example.com is not inherited automatically by bounce.example.com.

Can I copy the root-domain SPF record to the MAIL FROM subdomain?

Only after confirming that the subdomain uses the same legitimate senders. Blindly copying a record can authorize unnecessary sources or preserve obsolete includes.

Related email diagnostics

SPF terms after all are ignoredDiagnose SPF includes and redirects placed after all. Find unreachable sender authorization, reorder the policy safely, and verify the result. The SPF include or redirect target does not publish an SPF recordFind the exact SPF include or redirect target with no SPF policy. Diagnose a missing SPF dependency safely without removing legitimate sending services.

Primary sources: RFC 7208: identities checked by SPF, RFC 7208: selecting records.