SPF

Article

The Ultimate Guide to Checking SPF Syntax for Email Authentication

Ensure your email authentication is up to par with this ultimate guide to checking SPF syntax. Learn how to improve your email deliverability.

Article

The Ultimate Guide to Understanding the Difference Between SPF ~all and -all

A comprehensive guide to understanding the difference between SPF ~all & -all mechanisms. Tap to learn more!

Article

Understanding Broken SPF: What it is and How it Affects Your Email Deliverability

Is your email deliverability suffering? It could be due to a broken SPF. Don't let a simple error compromise your brand reputation!

Article

Unraveling the Mystery: Understanding SPF Failure and Its Impact on Email Deliverability

Struggling with SPF failure & wondering why your emails aren't getting delivered? Here's everything you need to know to fix the issue.

Article

An Easy Guide to Setting Up an SPF Record

How to setup an SPF record? This guide walks you through the steps to set up an SPF record and keep your emails safe from spoofing threats.

Article

Are SPF and DKIM Enough to Protect Your Email Domain Server?

Avoid getting phished by getting EmailAuth, a total DMARC implementation, and management tool. This

Guide

Changing SPF during an email-provider migration

Keep old and new sending paths authorised for the planned overlap, then remove the old path using evidence. An email migration is an identity and routing change, not just an SPF edit.

Guide

Custom MAIL FROM domains: verify SPF and DMARC alignment together

Validate a custom envelope domain using received messages, not just a successful DNS setup screen.

Guide

Hosted, dynamic and manually managed SPF: compare operating responsibilities

Manual, hosted and dynamic SPF labels describe different responsibilities, not different protocols. Compare who owns authorisation, DNS availability, change review and recovery.

Guide

Investigate a sudden drop in SPF compliance

Separate real authentication failures from changing traffic, alignment and reporting coverage before responding to a falling SPF percentage.

Guide

Maintain an SPF dependency register across business units

Build a register that connects SPF syntax, external dependencies and accountable business owners.

Guide

Multiple SPF records: merge permissions without retaining obsolete senders

Replace competing SPF records with one reviewed policy, preserving legitimate senders while removing stale or overbroad permissions.

Guide

Nested SPF includes: count dependencies before adding a service

Assess nested SPF dependencies using evaluated paths rather than counting only the includes visible in the customer record.

Guide

Remove a third-party sender from SPF without disrupting another service

Retire vendor authorisation by checking shared dependencies, infrequent senders and the difference between removing one mechanism and revoking every path.

Guide

SPF a and mx mechanisms: evaluate their DNS dependencies

Decide whether website and inbound-mail DNS should also control outbound sending permission.

Guide

SPF all qualifiers: compare fail, softfail, neutral and pass

Choose the final SPF result deliberately and keep authentication outcomes separate from receiver handling.

Guide

SPF and IP reputation: why authorisation does not establish reputation

Use SPF to establish authorised identity use, then investigate reputation and delivery as separate questions.

Guide

SPF and IPv6: detect senders missed by an IPv4-only review

Audit both address families so IPv6 delivery does not expose gaps hidden by successful IPv4 tests.

Guide

SPF and the visible From address: why passing authentication may not align

Separate an SPF pass from permission to use the visible author domain, then choose the supported repair.

Guide

SPF delegation: ownership, availability and exit requirements

Delegating SPF creates a dependency on another policy operator. Define the exact scope, failure behaviour, monitoring and replacement plan before relying on it.

Guide

SPF exists and macros: inspect the query that will actually be made

Expand an SPF macro with concrete inputs and inspect the DNS question before trusting the result.

Guide

SPF explained through the SMTP envelope identity

Find the domain SPF actually evaluates before editing DNS or drawing conclusions about the address a reader sees.

Guide

SPF failover when a sender uses a different envelope domain

Test the envelope domain as well as the sending IP when an application switches to its backup mail route.

Guide

SPF failures after a provider changes its sending addresses

When SPF failures follow a provider address change, verify the route and supported authorisation first. Repair the maintained policy source rather than accumulating emergency IP exceptions.

Guide

SPF failures concentrated in one recipient network

Compare the actual SMTP path, evaluated identity and DNS evidence before changing SPF to address failures at one recipient network.

Guide

SPF flattening: compare lookup relief with maintenance risk

Flattening can reduce DNS-dependent SPF evaluation, but it transfers responsibility for address changes to a refresh process. Compare both sides before choosing it.

Guide

SPF for shared sending infrastructure: limit over-authorisation

Review what an SPF mechanism authorises on shared infrastructure, then combine narrow policy design with provider-side identity controls.

Guide

SPF for subdomains: why authorisation is not inherited automatically

Identify the exact sending subdomain, then publish or delegate its SPF policy deliberately rather than relying on the parent record.

Guide

SPF HELO evaluation and messages with an empty reverse path

Test the identity used by bounce and notification traffic, including the HELO-derived SPF identity when MAIL FROM is empty.

Guide

SPF include loops and circular redirects

Trace recursive SPF references, distinguish include from redirect, and remove circular dependencies only with supported replacement evidence.

Guide

SPF include: authorise a service without copying its entire infrastructure

Use include to evaluate a service policy while keeping control of your own final SPF result.

Guide

SPF ip4 and ip6: authorise addresses and ranges accurately

Authorise the actual outbound addresses without accidentally granting an entire network more permission than it needs.

Guide

SPF mechanism order: measure the actual effect before rearranging entries

SPF mechanism order can change results and the evaluated path. Measure representative cases before moving entries, and do not use reordering to hide broken dependencies.

Guide

SPF neutral and none: interpret results without calling them authentication success

Distinguish a policy that makes no authorisation assertion from an identity with no usable SPF record, then investigate the right domain.

Guide

SPF over-authorisation: audit permissions that no longer have a business owner

Remove obsolete SPF permission through an owner-led inventory, observed sending evidence and a reversible retirement plan.

Guide

SPF passes in a tool but fails at the recipient

A checker and recipient can evaluate different identities, routes or DNS states. Reconstruct the recipient’s actual inputs before changing the policy.

Guide

SPF permerror: distinguish excessive lookups from malformed policy

Separate SPF syntax and record-selection failures from excessive evaluation budgets before proposing a correction.

Guide

SPF redirect: delegate policy and understand how it differs from include

Centralise SPF policy without accidentally disabling the delegation or changing its meaning.

Guide

SPF softfail versus hardfail: account for forwarding and receiver handling

Choose the final SPF qualifier by reviewing real sending paths, forwarding and receiver behaviour, rather than assuming it controls delivery.

Guide

SPF syntax: mechanisms, modifiers, qualifiers and evaluation order

Read an SPF policy as an evaluated program, not a bag of approved domains.

Guide

SPF temperror: investigate DNS failures and retry behaviour

Investigate transient SPF DNS failures without confusing the SPF result with a receiver’s SMTP response or a sender’s retry schedule.

Guide

SPF TXT strings and DNS record-length limits

Handle long SPF text as one TXT record with multiple strings, while checking DNS response size and evaluation complexity separately.

Guide

SPF TXT versus the deprecated type 99 record

Publish SPF version 1 in DNS TXT and retire obsolete type 99 dependencies without confusing a DNS interface label with a record type.

Guide

SPF void lookups: diagnose empty and non-existent DNS answers

Distinguish empty DNS answers from DNS failures and track void lookups along the actual SPF evaluation path.

Guide

SPF's 10-lookup limit: trace the evaluation path before fixing it

SPF limits evaluated DNS-dependent terms across the complete path. Nested includes count, early matches matter, and caching does not turn an over-limit path into a compliant one.

Guide

Test SPF using dig, nslookup and a received message

Use DNS queries to inspect publication and a real received message to inspect evaluation. Neither observation alone proves that all sending routes are correctly authenticated.

Guide

The deprecated SPF ptr mechanism and safer alternatives

Replace reverse-DNS-based SPF permission deliberately while retaining reverse DNS needed for other mail operations.

Guide

When flattened SPF records become stale

A flattened record can remain syntactically valid while its authorisations drift. Diagnose stale additions and removals separately, then restore a controlled refresh process.

Guide

Why SPF -all does not by itself guarantee receiver rejection

Understand what SPF -all asserts, when evaluation reaches it, and why a receiver’s final disposition needs separate evidence.

Guide

Why two SPF checkers may report different lookup counts

Two SPF tools may count different things or evaluate different paths. Reconcile the input fixture and trace before using a count to approve a DNS change.

How DMARC works, how to choose and tighten a policy, and how to reach p=reject safely with alignment you can trust.

20 guides

Keys, selectors, signatures and rotation: everything you need to sign mail and keep DKIM aligned.

8 guides

Put your verified logo in the inbox: BIMI records, SVG Tiny-PS logos, VMC and CMC certificates.

7 guides

Encrypt mail in transit with MTA-STS, TLS-RPT and DANE, and read the reports that prove it works.

3 guides