What SPF checks
SPF lets a domain publish which hosts may use it in SMTP identities, principally the envelope MAIL FROM and HELO identities. It does not directly authenticate the visible From address a person reads. Evaluation includes a limit of ten DNS-query-causing mechanisms/modifiers; nested includes count, while not every term consumes a lookup. Multiple SPF records for the same identity cause an error. [IETF RFC 7208: SPF]
Why an authorised message can fail
A forwarding service may transmit from an IP that was not authorised by the original envelope domain. An SPF result therefore needs the actual route and identity. [IETF RFC 7208: SPF]
Use DMARC to understand alignment with the visible From domain, and ARC when intermediaries are involved.
Our review checklist
- Inventory sending services and distinguish their envelope identities from their display From domains.
- Inspect a real failed message and the receiving system’s authentication result.
- Check the current record, nested includes and the accountable owner of each authorisation.
- Submit removals or additions through change control, with test messages and rollback recorded.
Do not publish a copied “universal SPF record” across all domains. The record must describe the services actually authorised. We deliver a documented sender inventory and proposed corrections through Email Review.
Primary sources
Provider requirements and product capabilities can change. Check the linked source before a production change.