DIAGNOSTIC PLAYBOOK
Circular SPF includes: trace and break the loop
A circular include or redirect causes SPF evaluation to revisit a dependency instead of reaching a useful authorization decision. The loop can consume the lookup budget and produce a permanent error.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Draw the dependency path beginning at the envelope domain and record every include and redirect target.
- Find the first repeated name and identify which party controls the reference that closes the loop.
- Replace the circular relationship with the provider's supported authorization, then retest the full tree.
What this looks like
ILLUSTRATIVE EXAMPLE
Domain A includes B, while B redirects back to A. Neither record looks large on its own, but the combined evaluation cannot resolve normally.
A mistake to avoid
Do not flatten a loop blindly. A snapshot of resolved addresses may omit the intended sending service and conceal the ownership mistake.
Keep the result in context
SPF evaluates the SMTP client against the envelope sender domain, or the HELO identity in the applicable case. A record lookup can identify publication problems; a message result also needs the actual sending IP and identity. Keep those inputs with your investigation.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.