SPF fails to verify

Question

SPF fails to verify

Craig Zivolich 20

Azure Email Communication Service - Provision domains, SPF fails to verify. Domain, DKIM, and DKIM2 successfully verified. "nslookup -q=TXT returns

    "v=spf1 include:spf.protection.outlook.com -all"

Accepted answer

0 additional answers

Your answer

Answer 1

TP 131.6K Volunteer Moderator

Hi Craig,

Your spf record appears correct. Did you recently make changes to or add the spf record? I'm asking because perhaps the previous record's TTL hasn't expired yet and you just need to give it some time to propagate.

If you would like to post your domain in a comment I will run some DNS queries from my end to double-check they are correct and are coming through to multiple geographic locations.

You seem to have already read ACS domain configuration troubleshooting article but I will post it below just in case you haven't.

https://learn.microsoft.com/en-us/azure/communication-services/concepts/email/email-domain-configuration-troubleshooting#2-unable-to-verify-spf-status

Thanks.

-TP

Craig Zivolich 20 Reputation points

2025-08-08T12:29:52.6966667+00:00

It's been a few days since I published the txt zone change. The SPF still will not verify. My domain is atsrmis.com. I saw something about "manual verification through azure support with business justification". Is that a way to get this verification to pass?
TP 131.6K Reputation points Volunteer Moderator

2025-08-08T14:00:15.97+00:00
It looks like your DNS configuration is incorrect. In regards to SPF, you have two records, one has redirect modifier:

"v=spf1 redirect=www.atsrmis.com"

There is no SPF record for www.atsrmis.com, so if Azure is following the redirect it will fail to verify. I recommend you remove the redirect TXT record.

Additionally, what DNS provider are you wanting to use for your domain?

Your domain record says you are using your registrar's name servers, but when I queried for NS records you have Cloudflare servers listed in your zone. I queried the Cloudflare servers and they are accepting queries for your domain.

Based on current configuration I believe most resolvers will return results from your registrar's servers, so hopefully that is want you intended.

While you are still troubleshooting, I recommend you reduce your TTL on your TXT to low number, say 10 minutes (600 seconds). Right now it is 3 hours so when you make changes it takes a while for them to take effect.

Once everything is working great you can increase TTL back to higher duration.
Craig Zivolich 20 Reputation points

2025-08-08T23:08:47.3966667+00:00

Removing "v=spf1 redirect=www.atsrmis.com" solved the issue. Thank you!!!!!

Share via

SPF fails to verify

0 additional answers

Your answer