SPF records not working? Troubleshooting guide

Symptoms#

• Messages landing in spam despite previously good placement
• Bounces mentioning policy, authentication, or reputation
• Provider dashboards showing a drop in reputation or authentication pass rate

Diagnosis steps#

1. Confirm the configuration is live: query DNS from an external resolver and check the sending platform's settings page.
2. Send to a seed mailbox and read the full headers, especially Authentication-Results.
3. Compare the domains in From, Return-Path, and DKIM d= for alignment.
4. Check provider dashboards (Google Postmaster Tools, Microsoft SNDS) for reputation and error rates.
5. Review recent changes: new vendors, DNS edits, list imports, volume spikes.

Likely causes#

• Exceeding the 10-lookup limit, which causes a permerror and effectively disables SPF.
• Publishing two SPF records on one domain; receivers treat this as a permanent failure.
• Forgetting that SPF checks the Return-Path (envelope sender), not the visible From address, so forwarded mail often fails.
• Using +all or leaving ?all in production, which authorizes everyone.

Fix and re-verify#

1. Inventory every service that sends mail as your domain: your ESP, CRM, helpdesk, billing system, and internal mail server.
2. Collect each vendor's SPF include mechanism (for example include:_spf.google.com) from their documentation.
3. Publish one TXT record at the root of the domain starting with v=spf1, listing each include, then ending with ~all (softfail) while testing.
4. Verify with a lookup tool that the record resolves and stays under 10 DNS lookups and 255 characters per string.
5. Move to -all once DMARC reports confirm all legitimate sources pass.

Frequently asked questions#