13 FOCUSED PLAYBOOKS
SPF diagnostics
Trace sender authorization, DNS evaluation and the envelope identity behind an SPF result.
SPF evaluates the SMTP client against the envelope sender domain, or the HELO identity in the applicable case. A record lookup can identify publication problems; a message result also needs the actual sending IP and identity. Keep those inputs with your investigation.
Run the SPF checker →SPF TempError: investigate a temporary DNS failure
An SPF TempError means evaluation could not finish because of a temporary problem, often a DNS lookup failure.
Read the playbook →DIAGNOSTIC PLAYBOOKSPF neutral: why the sender is neither approved nor denied
An SPF neutral result means the policy makes no assertion about the sending host.
Read the playbook →DIAGNOSTIC PLAYBOOKSPF none: find which domain was actually checked
SPF none means no applicable SPF policy was found, or no suitable domain identity was available for the check.
Read the playbook →DIAGNOSTIC PLAYBOOKSPF include target has no SPF record
An include mechanism depends on an SPF policy at its target domain.
Read the playbook →DIAGNOSTIC PLAYBOOKCircular SPF includes: trace and break the loop
A circular include or redirect causes SPF evaluation to revisit a dependency instead of reaching a useful authorization decision.
Read the playbook →DIAGNOSTIC PLAYBOOKSPF fails only over IPv6
An IPv6 delivery path can fail SPF even when messages sent over IPv4 pass.
Read the playbook →DIAGNOSTIC PLAYBOOKSPF void lookups: empty DNS answers in the evaluation chain
Void lookups are DNS queries that return no applicable answer or a name error during SPF evaluation.
Read the playbook →DIAGNOSTIC PLAYBOOKWhy an SPF redirect is never used
An SPF redirect applies only after mechanisms fail to match.
Read the playbook →DIAGNOSTIC PLAYBOOKSPF macros: inspect the name that gets queried
SPF macros construct domain names from evaluation inputs such as the sender or IP address.
Read the playbook →DIAGNOSTIC PLAYBOOKSPF and empty return paths: check the HELO identity
Mail with an empty reverse path, such as a delivery status notification, needs different SPF context from an ordinary message.
Read the playbook →DIAGNOSTIC PLAYBOOKSplit SPF TXT strings: one record or two records?
DNS can store multiple character strings inside one TXT record.
Read the playbook →DIAGNOSTIC PLAYBOOKA flattened SPF record is stale: recover provider coverage
A flattened SPF record can keep authorizing old IP addresses after a sending provider changes its infrastructure.
Read the playbook →DIAGNOSTIC PLAYBOOKSPF on a delegated subdomain: find the right DNS owner
A delegated subdomain can have its own authoritative DNS service.
Read the playbook →