Start with the envelope sender
SPF checks whether a connecting server is authorized to use an SMTP sending identity. That identity can differ from the From address someone sees in their inbox. A pass for a provider’s domain does not automatically authenticate your visible From domain.
Read the evidence in your report
In CheckDMARC, start with the reported SPF result and envelope-from domain. Compare that domain with the visible From domain, then look at the published SPF record. The receiving server’s result describes the message when it arrived; the DNS shown in a later check may have changed.
| Result | Next step |
|---|---|
| pass | Check whether the authenticated domain aligns with From. |
| fail or softfail | Confirm the actual sending service and IP before changing its authorization. |
| permerror | Inspect record syntax, duplicate SPF records and DNS lookup limits with your provider. |
| none or missing | Check whether the relevant sending domain publishes SPF and whether the original headers are complete. |
Fix the sending route, then send again
List the services that send your mail: your mailbox, website forms, invoices and newsletters may use different routes. Obtain the exact SPF instructions from each provider. Maintain one SPF policy record for a domain rather than adding a second competing record.
SPF limits DNS-querying mechanisms and modifiers during evaluation; a long chain of includes can cause an error. Adding another include is therefore not a universal fix. Forwarding can also change the connecting server and affect SPF.
Identify one failing route
Send a new message from that service and record its envelope-from identity.
Confirm the intended configuration
Use the provider’s current instructions and review the relevant domain’s existing record before editing DNS.
Repeat the same test
Allow for DNS caching, create a fresh test address and send through the same service again.
Sources
Sources checked on 6 November 2026. Provider guidance can change.