DMARCGuardian Practical help for DMARC, SPF, DKIM, and BIMI.

Blog · Spf

Why SPF Records Suddenly Break and How to Fix Them

By DMARCGuardian Editorial Team ·

SPF was working. Now Microsoft is rejecting your mail. This is one of the most common email authentication problems sysadmins face, and it almost always happens after a change you did not expect to cascade.

Here are the six most common reasons an SPF record stops working, in order of how often they show up in practice.

1. You added a new service without updating SPF

The most common cause. Any service that sends mail on behalf of your domain needs to be in your SPF record. If it is not, it will fail.

Common offenders:
  • Microsoft 365 without the correct include
  • Google Workspace
  • Mailchimp, SendGrid, Mailgun, or other bulk mail platforms
  • CRMs with built-in email sending
  • Cloud services that send transactional email

Fix it: add the vendor's SPF include to your record. Microsoft 365 uses include:spf.protection.outlook.com. SendGrid uses include:sendgrid.net. Check your vendor's documentation and add their specific include mechanism.

2. Your server IP address changed

Moved a mail server? Migrated to a new cloud instance? Your SPF record still points to the old IP. Any mail sent from the new address fails SPF because the record does not list it.

Fix it: update the a or ip4 mechanisms in your SPF record. Run dig TXT yourdomain.com +short to see your current record, find the mechanism listing the old IP, and replace it with the current one.

3. You exceeded the 10-lookup limit

This one catches experienced admins. RFC 7208 limits every SPF record to a maximum of 10 DNS lookups. Each include:, a:, mx:, ptr:, and redirect= counts as one. Stack up too many includes and validation breaks silently at some receivers.

Signs you are near the limit:
  • SPF fails only for certain recipients
  • Your record has more than five include: mechanisms
  • You recently added a vendor that chains multiple includes

Fix it: count your lookups with a tool like the Google Admin toolbox or kitterman.com. Consolidate by replacing multiple vendor includes with the vendor's base domain include once. For Microsoft 365, for instance, one include:spf.protection.outlook.com replaces several older includes.

4. A vendor changed their SPF infrastructure

Vendors reorganize their mail backend without always announcing it. If a vendor you include stopped resolving, your record references nothing.

Fix it: re-run your vendor's current setup procedure and compare their recommended include with what you have. If they do not match, update your record.

5. A typo or accidental truncation

SPF syntax is unforgiving. One wrong character breaks the whole record.

Common mistakes:
  • Missing closing quote
  • Wrong qualifier (+, -, ~, ? only)
  • Space embedded where there should not be one
  • Extra dots in domain names

Fix it: validate your record at kitterman.com/spf/validator.html. It will tell you exactly where the record breaks.

6. DNS propagation delay

SPF records are DNS TXT records. They propagate like any other DNS change, typically within minutes but occasionally taking up to 48 hours.

Fix it: check what your record looks like from multiple locations using an online DNS checker. If it looks correct externally and SPF is still failing, wait a few hours before making more changes.

How to Validate Your SPF Record

After any fix:

1. Run dig TXT yourdomain.com +short and confirm it looks right.
2. Check the syntax with an SPF validator tool.
3. Send a test to check-auth@verifier.port25.com for an authenticity report.
4. Watch your DMARC aggregate reports for decreasing SPF alignment failures.

How to Monitor SPF Health Going Forward

SPF breakage is rarely a one-time event. Services get added, IPs rotate, vendors change infrastructure. The next breakage will happen. The question is whether you find out from a monitoring alert or from your CEO asking why his newsletter went to spam.

DMARCFlow monitors SPF and DKIM continuously and alerts you when authentication rates change. You catch SPF breakage hours after it happens instead of days later when the complaints pile up.

FAQ

How do I check if my SPF record is working?
Send a test email to check-auth@verifier.port25.com. You get back a report showing whether SPF passed or failed and why.

What does SPF fail mean for my email?
When SPF fails, the receiving server may reject the message, flag it as spam, or accept it with a low reputation score. SPF failure does not automatically mean rejection.

Can SPF and DKIM both pass but DMARC still fail?
Yes. SPF and DKIM validate the sending server. DMARC also requires alignment: the domain in the From header must match the domain authenticated by SPF or DKIM. This alignment requirement trips up many administrators even when both SPF and DKIM individually pass.

What is the difference between SPF pass and DMARC pass?
SPF pass means the sending server IP is authorized for the envelope-from domain. DMARC pass means the From header domain is aligned with the authenticated domain. They are different checks and both must pass, with alignment, for full DMARC compliance.