Troubleshooting

SPF record broken and I did not know it. Here is how to check yours

spf_disaster · 2026-04-02T00:00:00Z

Broken SPF record tanked deliverability for 2 weeks before I found it. Found it with MxToolbox. SPF record must include all sending services. Syntax matter

spf_disaster · 2026-04-02 · 1,980 views

My SPF record was broken for 2 weeks and I didn't know it. Reply rates dropped from 3.5 percent to 0.9 percent. I blamed copy, targeting, list quality, everything. The actual cause was a misconfigured SPF record that took 5 minutes to fix once I found it.

How I found it. Ran my domain through MxToolbox SPF checker. The tool flagged that my SPF record was syntactically valid but missing the include for a third party sending service I'd added a month earlier. All mail from that service was failing SPF authentication, which cascaded into DMARC failures, which pushed my emails to spam.

The fix. A proper SPF record looks like v=spf1 include:_spf.google.com ~all. If you're sending through multiple services, you include each one: v=spf1 include:_spf.google.com include:servers.mcsv.net ~all. The tilde before "all" is a soft fail, meaning "if a message claims to be from us but isn't from these services, treat it as suspicious but not definitively spam." The dash version (-all) is hard fail, which rejects completely.

Common SPF mistakes I see. Having multiple SPF records on the same domain (you can only have one, they don't stack). Missing includes for services you added after initial setup. Typos in the include domain (e.g. _spf.google.com vs spf.google.com). Using -all when you're not 100 percent sure every sending service is included (breaks legitimate mail from services you forgot). Missing the ~all or -all terminator entirely (makes the record technically invalid).

How to check yours. Go to mxtoolbox.com/spf.aspx. Enter your domain. Review the output. MxToolbox flags common issues and shows you exactly what your record looks like to receiving servers. Run this check monthly. SPF records don't break randomly, but they do break when you add new sending services and forget to update the record.

SPF is the kind of thing that works until it doesn't, and when it doesn't work, the symptoms look like every other deliverability problem. Ruling out SPF misconfiguration should be the first diagnostic step when reply rates drop unexpectedly.