Check any domain's SPF record for errors, analyze mechanisms, and verify you're under the 10-DNS-lookup limit.
SPF (Sender Policy Framework) is a DNS TXT record that specifies which mail servers are authorized to send email on behalf of your domain. When a receiving server gets an email, it checks the SPF record of the sender's domain to verify the email came from an authorized server.
An SPF record starts with v=spf1 and contains a list of mechanisms like include:, ip4:, a, and mx, ending with an all mechanism.
SPF is limited to 10 DNS lookups per evaluation (RFC 7208). Each include:, a, mx, and redirect= counts as one lookup. Exceeding this limit causes a permerror, which means SPF effectively fails for your domain.
SPF fundamentally breaks when email is forwarded. The forwarding server's IP isn't in the original sender's SPF record, so SPF fails. This is why SRS (Sender Rewriting Scheme) exists — it rewrites the envelope sender so SPF checks the forwarding server's domain instead.
ARC-Relay uses SRS automatically, so your forwarded emails always pass SPF at the destination.