Fix guide 2 min read

SPF record or alignment issue

How to confirm SPF is authorizing the sender path and aligning with the visible sender identity.

By Sendlander editorial team Published August 20, 2026 Last reviewed August 20, 2026 Technical review: Sendlander deliverability team

Use the steps for your setup.

Authorize the real outbound service in one SPF record and make its return-path align with the visible From domain where possible.

Finding: AUTHENTICATION.SPF
Reviewed: 2026-08-21

Before you change anything: Never publish a second SPF record at the same hostname. Merge every legitimate sender into one valid record and keep within SPF lookup limits.

1. Fix it in the sending platform

Where was the failed email sent from?

Google Workspace

Authorize Google only if Google Workspace actually sends this mail, then include every other legitimate sender in the same record.

1
Inventory every service that sends using this domain before editing DNS.
2
Use Google's current Workspace SPF include in the domain's single SPF TXT record, merged with any other approved senders.
3
Send again through Google Workspace and confirm the return-path SPF result passes; check alignment separately.

Open the official instructions

2. Publish the DNS records

Where is this domain's DNS managed?

Cloudflare

Publish the exact record supplied by your sending platform in Cloudflare DNS.

1
Open the domain in Cloudflare, then go to DNS → Records and choose Add record.
2
Choose the record type shown by your sending platform and paste the supplied name and value exactly.
3
For email-authentication CNAME records, use DNS only rather than the orange-cloud proxy, then save.

Open the official instructions

3. Prove SPF and alignment are fixed

A DNS checker proves the record exists; a delivered message proves the real sending path uses it.

1
Exactly one SPF TXT record exists at the checked hostname.
2
The new message's Authentication-Results header says spf=pass for the actual return-path domain.
3
For DMARC, the passing return-path domain aligns with the visible From domain, then a fresh Sendlander test clears the finding.

Run the verification test

Why this matters

SPF authorizes the servers allowed to send for a domain. For DMARC, the passing SPF domain must also align with the visible From domain.

A message can show spf=pass and still fail alignment if the return-path domain belongs to another provider or subdomain.

How to fix it

Add the sending provider's include mechanism or sending IP to the SPF record for the correct domain. Keep the record under the DNS lookup limit.

If alignment is the issue, configure a custom return-path or bounce domain in the sending platform and rerun the test.