A short SPF record can hide a long path to one sender. This worked support case follows an invoice error through the nested records and the checks needed before a correction.
The record is short; the failing path is not
In this fictional support case, staff email works but a client's invoicing service gets an SPF permanent error. The domain has three provider includes. Looking only at that line makes the record appear comfortably inside the limit.
Following the nested records tells a different story. Staff mail matches after two counted lookups. The invoicing sender reaches an eleventh before it can match, so that SPF evaluation returns a permanent error. These counts describe the example's sending paths, not a measured client incident.
What the technician needs to establish
| Evidence | Why it matters |
|---|---|
| The invoice's actual return-address domain and sending IP | Establishes the identity and sender whose policy must be checked. |
| The full SPF reference chain | Reveals lookup costs hidden behind the top-level includes. |
| Which applications still use each authorisation | Prevents removing a working sender just because its entry looks unfamiliar. |
| A test from each affected sending service after the change | Checks the outcome for those senders rather than relying on staff email alone. |
The worked lookup example explains how SPF stops at different points for different senders. The MSP audit guide covers the evidence worth retaining with a client record.
Choose a correction that preserves the senders
An obsolete include is a candidate for removal only after the application owner confirms it is no longer needed. If the record still needs the supported references that take the failing path over the limit, automatic flattening can reduce those lookups by publishing their IP ranges instead.
That choice depends on the policy and provider guidance. Invalid syntax, broken references and unsupported dynamic rules need separate attention. A lower lookup count is not enough if the replacement drops a legitimate sender.
Use the SPF change simulator to inspect a proposed edit before publishing it, within the tool's supported rules. Follow with actual sending tests; a simulated record comparison cannot prove delivery.
What stays with the MSP
Emailmetry keeps supported flattened IP ranges current as providers change them. Its compatibility details describe the limits. The MSP and client still decide which services should be authorised and update that selection when a service is added or retired.
The support benefit is specific: reducing a lookup chain can resolve that source of errors. It does not eliminate sender discovery, DNS ownership or the need to verify the affected application.
Sources and further reading
Sources reviewed 12 September 2026.