Adding a new sender to SPF safely

A new vendor sends you a setup page telling you to add an include to your SPF record. That instruction is correct but incomplete. It assumes you have lookup budget to spare and that nothing else about your record matters.

Before you edit

1. Count your current lookups. If adding the vendor's include would take you past ten, fix that first, because the new sender would otherwise break every existing one.
2. Check whether the vendor also needs DKIM records. Adding SPF alone leaves you dependent on the envelope sender aligning, which for most vendors it does not.
3. Decide whether the sender belongs on the root domain at all. Bulk and transactional mail is often cleaner on a dedicated subdomain.

Making the change

v=spf1 include:_spf.google.com -all
v=spf1 include:_spf.google.com include:vendor.example.net -all

Add the include before the all mechanism. Anything after all is dead text, because evaluation never reaches it.

After you edit

1. Wait for the old record's TTL to expire, then confirm the new record is live from more than one resolver.
2. Re-count lookups against the live record, not the one you intended to publish.
3. Send a test message through the new service and read the Authentication-Results header on arrival.
4. Check the next DMARC aggregate report for the vendor's IPs showing a pass.