How to Fix SPF Fail: Step-by-Step Guide (2026)

Seeing SPF failures in your deliverability reports? This usually means an unauthorized server is sending email on your behalf, or your SPF record has a critical error. Here's exactly how to diagnose and fix SPF fail in 5 steps.

Understanding SPF Failure

An SPF failure occurs when a receiving mail server checks your domain's SPF record and determines that the server sending the email is not authorized. This can happen for several reasons:

• Missing Sending Service: You've added a new email service provider (ESP) but haven't updated your SPF record to include their servers.
• Multiple SPF Records: Your domain has more than one SPF record, which causes a "permerror" and fails all checks.
• 10-Lookup Limit Exceeded: Your SPF record requires more than 10 DNS lookups, triggering a "permerror."
• Syntax Errors: A typo in your SPF record makes it invalid.
• Forwarding Issues: An email was forwarded through a server not listed in your SPF record.

Step 1: Identify the Sending IP or Service

First, you need to know which server is sending the unauthorized email. Here's how to find it:

• Check the Email Tester Report: If you used our Email Tester, the report will show the exact IP address that sent the email.
• Review Email Headers: Use our Email Header Analyzer. Paste the raw headers and look for the "Received" fields—they show the path the email took.
• Check DMARC Reports: If you have DMARC set up, the aggregate reports (RUA) will show which IPs are sending email on your behalf.

Once you have the IP address, you can identify which service is using it. Common examples:

• Google Workspace: IPs like 209.85.xxx.xxx or 64.233.xxx.xxx
• Microsoft 365: IPs in the 40.xxx.xxx.xxx range
• SendGrid: IPs in the 168.245.xxx.xxx range
• Amazon SES: IPs vary by region

Step 2: Update Your SPF Record

Once you've identified the unauthorized service, you need to add it to your SPF record. There are two main mechanisms:

• include: Mechanism: Most ESPs provide an include: string. For example:
  • Google Workspace: include:_spf.google.com
  • SendGrid: include:sendgrid.net
  • Amazon SES: include:amazonses.com
  • Mailchimp: include:servers.mcsv.net
• ip4: or ip6: Mechanism: If you have a dedicated IP address, you can add it directly:
  • ip4:192.0.2.1
  • ip6:2001:db8::1

Example: If your current SPF record is v=spf1 include:_spf.google.com ~all and you want to add SendGrid, the updated record would be v=spf1 include:_spf.google.com include:sendgrid.net ~all.

Step 3: Merge, Don't Duplicate

This is critical: A domain must have exactly one SPF record. If you already have an SPF record (check with our SPF Checker), you must merge the new mechanism into the existing record.

Having two SPF records is explicitly invalid per the SPF specification and will cause a "permerror," making all your SPF checks fail.

Step 4: Avoid the 10-DNS-Lookup Limit

SPF allows a maximum of 10 DNS lookups. Each include:, a:, mx:, and exists: mechanism counts as one lookup. If you exceed 10, the SPF check returns a "permerror" and fails.

How to avoid it:

• Consolidate services: Do you really need five different ESPs? Consider using a single primary ESP.
• Use IP addresses instead: If a service has a dedicated IP, use ip4: instead of include: (this doesn't count as a lookup).
• Use SPF flattening: Some providers (like SendGrid) offer a "flattened" SPF record that expands their includes into raw IPs.

To check your current lookup count, use our SPF Checker. It will show you how many lookups your record requires.

Step 5: Verify Propagation

After updating your DNS, you need to confirm the changes have propagated and the record is syntactically correct.

1. Wait a few minutes: DNS propagation can take anywhere from a few minutes to 48 hours.
2. Use the SPF Checker: Our SPF, DKIM & DMARC Checker will show you the live record and any syntax errors.
3. Send a test email: Use the Email Tester to send a real email and confirm SPF now passes.

Common SPF Fix Mistakes

• Creating a second record: Always merge, never create a new one. This is the most common mistake.
• Typos: A missing dot, space, or wrong character breaks the record. Always copy-paste from a generator.
• Forgetting to update after provider changes: Always revisit your SPF when you add or change email services.
• Not checking the 10-lookup limit: Adding too many includes can break your SPF silently.

Frequently Asked Questions

Conclusion

Fixing SPF fail is a straightforward process: identify the unauthorized sender, update and merge your SPF record, and verify the changes. The key is to always merge, never duplicate, and keep an eye on the 10-lookup limit.

Ready to fix your SPF? Start with our SPF Checker to see what's currently published.