SPF Troubleshooting
Most SPF incidents come from multiple TXT records, more than 10 DNS lookups, missing vendor includes, or misunderstanding that SPF alone is not DMARC.
Diagnostic checklist
Lookup TXT at the envelope domain, ensure a single v=spf1 string, expand includes, count lookups, test the sending IP, then check DMARC alignment separately.
PermError playbook
Remove dead includes, split senders onto subdomains, or adopt QuickSPF rather than endless manual flattening.
How QuickDMARC helps
SPF checker + QuickSPF + DMARC monitoring cover DNS validation and ongoing traffic proof.
Frequently asked questions
Two SPF records—what happens?
SPF evaluation should return PermError. Merge into one.
SPF pass but mail in spam?
Content, reputation, and DKIM/DMARC still matter.
Best first tool?
SPF checker, then DMARC reports for real sources.