Check publication before evaluating a sender
A domain should publish one SPF record. This diagnostic exposes the record, its terminal all mechanism, and the mechanisms that directly trigger DNS lookups.
- Multiple SPF records produce a permanent evaluation error.
- The RFC limit applies to recursive evaluation, not only visible include terms.
- SPF can pass while DMARC fails when the authenticated identity is not aligned.