Lock the default route
Make `-all` your friend. If you must start with `~all` for legacy senders, schedule a follow-up to tighten policies once those systems authenticate correctly.
The 48-hour SPF sprint
Condense a sprawling SPF portfolio into precise, hardened records that pass Gmail and Yahoo checks—even across hybrid infrastructure.
Sprint checklist
Run the following phases back-to-back. Use the SendCheck workspace dashboard to validate each change before shipping to production DNS.
Phase 1 · Discovery (6 hours)
- Export the domain roster from SendCheck and tag each with business owner and outbound systems.
- Collect existing SPF records using SendCheck’s deterministic engine and cross-check with `dig +short txt` to validate caching layers.
- List every mechanism and redirect in a spreadsheet grouped by service.
- Identify legacy or redundant entries (e.g., `include:spf.protection.outlook.com` and `include:spf.protection.outlook.com:spf`) that bloated the lookup depth.
Phase 2 · Rationalize (18 hours)
- Create sub-delegations for non-business critical senders. Example: move contractors to `spf.contractors.example.com` and reference once from the root record.
- For each mechanism, confirm it is still required by checking current send logs and contacting the owner if usage is unclear.
- Flatten overlapping services. For instance, if both SendGrid and Mailgun use the same underlying IP ranges, prefer one host that you actively use.
- Simulate the new record with SendCheck to ensure the total lookup count is < 8 for headroom and that `-all` is applied where possible.
Phase 3 · Ship & monitor (24 hours)
- Stage changes in a pull request or DNS change request. Include SendCheck’s remediation snippet for historical context.
- Deploy during a low-volume window and monitor SendCheck’s drift alerts across 4 consecutive checks.
- Enable nightly monitoring and set notification routing by domain owner using Slack or email connectors.
- Document the before/after SPF record and lookup count in your deliverability wiki.
Pro tips from the field
Segment by business unit
Break down responsibilities so marketing, product, and transactional teams know which DNS sub-delegation belongs to them. SendCheck workspace tags keep ownership visible.
Need help flattening complex records?
Our deliverability engineers help teams migrate to provider-managed sub-delegations without downtime.