SPF (Sender Policy Framework)

SPF is a TXT record in your domain's DNS. It starts with 'v=spf1' and lists the servers and services that are allowed to send mail for the domain. When a message arrives, the receiving server looks at the domain in the envelope sender (the Return-Path) and checks whether the connecting IP address is on that list. If it is not, the message can fail SPF.

SPF has two strict rules. A domain may publish only one SPF record, and a check may use at most 10 DNS lookups. Every 'include', 'a', 'mx', 'ptr', 'exists' and 'redirect' counts toward that limit. If you add one tool after another, you can pass the limit without noticing, and the receiver then treats the whole record as broken.

For cold email, the usual mistakes are a second SPF record added by a new provider, and a record that does not list the service that actually sends your mail. The fix is to keep one record, include each real sender once, and end it with '~all' or '-all'. Check it after every change to your email setup.