DIAGNOSTIC PLAYBOOK
Why an SPF redirect is never used
An SPF redirect applies only after mechanisms fail to match. An all mechanism always matches, so a policy containing all will not reach its redirect modifier.
HealthCheck Email editorial team · · Examples are illustrative
How to investigate
- Read the record in evaluation order and locate any all mechanism.
- Decide whether the domain should delegate the entire unmatched policy or combine multiple authorized senders.
- Use the intended include or redirect structure and test known authorized and unauthorized IPs.
What this looks like
ILLUSTRATIVE EXAMPLE
A policy contains an include, then ~all, then redirect=policy.example. The softfail match ends evaluation before the redirect can control the result.
A mistake to avoid
A redirect is not an additional sender include. Moving or removing it without understanding the intended policy can change who is authorized.
Keep the result in context
SPF evaluates the SMTP client against the envelope sender domain, or the HELO identity in the applicable case. A record lookup can identify publication problems; a message result also needs the actual sending IP and identity. Keep those inputs with your investigation.
Take the next step
Use the related check to gather evidence, then compare it with the affected message or service. Keep the result and time with your notes so a later change can be distinguished from the original problem.
Sources and further reading
The protocol references below explain the underlying behavior. Your sending or DNS provider supplies the account-specific settings for its service.