Loading Empire…

Skip to content

Learn Fix Tools

Search/

Appearance

Filter problems…

SPF Problems
DKIM Problems
DMARC Problems
DNS & Infrastructure Problems
Delivery Problems
Inbox Placement Problems
Provider Problems
Reputation Problems
Campaign Performance Problems
- High unsubscribe rate
- Low open rate
Warmup Problems

Home
Fix
SPF Problems
Incorrect IP authorization

Incorrect IP authorization

Sending infrastructure IPs are not authorized by SPF.

Reading time:: 5 min
Difficulty:: Intermediate
Estimated duration:: 5 min
Prerequisites:: None
Last updated:: 2026-07-15
Author:: empire

Problem summary

Sending infrastructure IPs are not authorized by SPF.

Severity: High

Symptoms

spf=fail or softfail from your own ESP/MTA IPs
DMARC reports show legitimate sources failing SPF
New sending IP ranges were never added

Possible causes

Missing ip4/ip6 or include for the active egress
Shared pool IP change not covered by include
MAIL FROM domain differs from the domain you edited

How to diagnose

Capture the connecting IP from SMTP logs or Authentication-Results
Evaluate SPF for that IP against the MAIL FROM domain
Confirm which domain’s SPF the ESP actually uses (Return-Path)

How to fix

Add the correct include or CIDR for the sending infrastructure
Align Return-Path/MAIL FROM with the domain you intend to authorize
Retire obsolete IPs from the record after cutover

How to verify

Same egress IP now yields spf=pass
DMARC rows for that source flip to SPF pass

Prevention

Update SPF as part of IP/pool change tickets
Inventory Return-Path domains per stream

When to escalate

Production mail is failing for a material share of recipients after remediation attempts

SPFSender Policy Framework — authorizes hosts that may send for a domain.

Broken SPF includeAn included SPF domain is missing, invalid, or fails closed.
Forwarded email fails SPFForwarding paths break SPF because the forwarder is not authorized.
Invalid SPF mechanismSPF record contains unsupported or malformed mechanisms.
Multiple SPF recordsMore than one SPF TXT record exists, causing evaluation failure.
SPF passes but DMARC failsSPF authenticates a domain that does not align for DMARC.
SPF PermErrorSPF evaluation fails permanently due to policy or lookup errors.
SPF record missingNo SPF TXT record is published for the sending domain.
SPF TempErrorTemporary DNS or evaluation failure during SPF checks.
Too many DNS lookupsSPF evaluation exceeds the ten-lookup limit.

digCLI DNS lookup utility for authoritative and recursive inspection of mail-related records.
MXToolboxPopular DNS and mail diagnostics suite for SPF, DMARC, blacklist, and MX checks.
Mail-TesterSend-a-message spam and authentication scoring for pre-send QA.
Kitterman SPF validatorClassic web SPF policy evaluator used by operators for syntax checks.

PreviousForwarded email fails SPF NextInvalid SPF mechanism

Company

About
Contact
Services

Platform

Learn
Fix
Tools

Community

Empire is a living operator community — share practice, follow releases, and help shape the knowledge base.

Newsletter — coming soon

Legal

Privacy Policy
Terms of Use
Disclaimer
Editorial Policy
Cookie Policy

© 2026 Empire Email

Independent educational platform focused on email infrastructure, deliverability, and lifecycle marketing.