1. Find the identity being evaluated

Inspect the trusted receiver’s SPF result and note its smtp.mailfrom identity. There are special cases for empty envelope senders, so preserve the full result rather than guessing from the visible From address. Work with the exact domain from that evidence.

Write down the sending service and the connecting IP as well. Without these, a DNS lookup can show that a policy exists but cannot explain whether this particular sender was authorized.

2. Read DNS before changing it

Query the TXT records at the exact name. This command is a syntax example using a reserved example domain; it is not an instruction to edit example.com:

dig TXT example.com

Look for a policy beginning with v=spf1. Preserve other TXT records. If there are multiple SPF policies at the same name, do not choose whichever looks newest: collect the intended sender authorizations and plan one reviewed policy.

3. Compare the policy with your sender inventory

Mark each authorized service and who owns it. Ask the provider for its current DNS instructions. Do not paste a tutorial’s include into production or remove an unfamiliar entry merely because you do not recognize it.

Review lookup-causing mechanisms and their nested dependencies. A short-looking policy can still have a complex dependency chain. Keep a record of the lookup evidence, timeouts, and unsupported responses; a failed lookup is not evidence that a sender should be removed.

4. Verify a fresh message

After an approved edit, compare authoritative and recursive DNS answers while allowing for caching. Send a fresh test through every affected service. Record the receiver’s result and the actual identity it evaluated.

Finally, review DMARC alignment separately. SPF authorization for an unrelated envelope domain does not establish that the visible From domain aligns. If the message travels through a forwarder, investigate that path before concluding the original service is misconfigured.

Before you move on

  • Exact SPF identity captured.
  • All legitimate sending services accounted for.
  • One reviewed policy at the relevant DNS name.
  • Fresh message evidence recorded after the change.