Email & DNS guide
How to fix common SPF problems
Resolve duplicate policies and missing senders without accidentally removing legitimate email services.
1. Save your current records
Export or copy the DNS records before editing. Identify every TXT record that starts with v=spf1 at the affected name. Unrelated verification records are not duplicates and should remain. Keep the hostname with the record so a subdomain policy is not confused with the apex policy.
2. Combine duplicate policies carefully
Build a list of mechanisms needed by active providers. Create one policy containing the approved mechanisms and one appropriate final all mechanism. Do not simply join two complete record strings: there should be only one version declaration, and mechanisms after an all term are not useful.
3. Investigate lookup errors
An SPF permerror can come from syntax errors, duplicate records or excessive DNS lookups. Follow include and redirect policies to understand their dependencies. This site's basic parser does not perform a full recursive evaluation. Ask the provider for its supported consolidated configuration when the policy is too complex.
4. Test actual sending
After DNS caches refresh, send a message from each authorized service. Inspect the recipient's SPF result and the envelope domain it checked. If SPF passes but DMARC fails, investigate alignment and DKIM. Review unused senders periodically instead of allowing the policy to grow indefinitely.
Primary references
Provider dashboards and instructions can change. Confirm current values with your provider before editing DNS.