Broken SPF include
An included SPF domain is missing, invalid, or fails closed.
Problem summary
An included SPF domain is missing, invalid, or fails closed.
Symptoms
- An include: target has no usable SPF or returns errors
- Parent domain SPF fails when that include is evaluated
- Vendor SPF hostname changed after a product rename
Possible causes
- Stale include hostname from old ESP docs
- Include domain missing v=spf1
- Typo in the include domain
How to diagnose
- Resolve TXT for each include target independently
- Confirm current include hostname in vendor documentation
- Check whether the vendor moved customers to a new include
How to fix
- Update or remove the broken include
- Replace with the vendor’s current mechanism or required IPs
- Re-test every sending stream that depended on that include
How to verify
- Each include target publishes valid SPF
- End-to-end spf=pass for affected platforms
Prevention
- Track vendor SPF include hostnames in a change log
- Re-check includes after ESP account or product migrations
When to escalate
- Production mail is failing for a material share of recipients after remediation attempts