One wrong include: line fails SPF for every message you send.

1. include:_spf.klaviyo.com or include:spf.klaviyo.com

Neither name exists in DNS: both return NXDOMAIN (measured 13 Nov 2026 through 1.1.1.1). Klaviyo’s own domain does not include them either. Several blog posts suggest one of these lines for Shopify + Klaviyo stores; we found them on 8 of the 30,000 domains. Because the name has no SPF record, the whole SPF check returns permerror, including for Google Workspace or Microsoft 365 mail listed in the same record.

Fix: delete the include. If you want Klaviyo mail authenticated as your domain, use the DNS records Klaviyo shows in your own account for a branded sending domain.

v=spf1 include:_spf.google.com include:_spf.klaviyo.com ~all
v=spf1 include:_spf.google.com ~all

2. include:email.freshdesk.com plus two or three other services

email.freshdesk.com on its own costs 7 of your 10 DNS lookups: itself, sendgrid.net (which includes ab.sendgrid.net), and four regional records (US, EU, India, Australia). Add Google Workspace and one marketing tool and the record goes over 10. Of 65 domains we saw with this include, 29 were over the limit. Services listed after the 10th lookup are not checked; their mail fails SPF.

Fix: replace it with SendGrid plus only the region your Freshdesk account is in. For a US account:

v=spf1 include:email.freshdesk.com include:_spf.google.com include:spf.protection.outlook.com include:servers.mcsv.net include:mail.zendesk.com ~all   (11 lookups)
v=spf1 include:sendgrid.net include:fdspfus.freshemail.io include:_spf.google.com include:spf.protection.outlook.com include:servers.mcsv.net include:mail.zendesk.com ~all   (7 lookups)

Other regions: fdspfeuc.freshemail.io (EU), fdspfind.freshemail.io (India), fdspfaus.freshemail.io (Australia). Your Freshdesk URL or account settings tell you which one.

3. A service you stopped using years ago

Old includes stay in DNS long after the service is gone. On 13 Nov 2026 these had no SPF record, but domains still included them:

Fix: delete the include. A name with no SPF record authorises nobody, so removing it cannot stop mail that was passing.

4. A typo in a big provider’s name

In a wider scan of 300,000 .com and .co.uk domains the most common were spf.google.com (31 domains), shops.myshopify.com (15) and smtp.secureserver.net (12).

Fix: correct the name. One character, and every message from the domain goes from permerror to a real SPF result.

5. No space before ~all or -all

Without the space, the last include and the all become one name, which does not exist, so the check ends in permerror. We found 88 domains like this in the 300,000 scan.

v=spf1 include:_spf.google.com~all
v=spf1 include:_spf.google.com ~all
v=spf1 include:spf.protection.outlook.com include:sparkpostmail.com-all
v=spf1 include:spf.protection.outlook.com include:sparkpostmail.com -all

6. Pasted text: include:v=spf1 and example values

When a second record is pasted into the first, the text include:v=spf1 ends up inside it (7 domains in the 300,000 scan). Another 5 include u123456.wl.sendgrid.net, which looks like a placeholder from a setup guide and does not exist. Both end in permerror.

v=spf1 include:_spf.google.com ~all include:v=spf1 include:sendgrid.net -all
v=spf1 include:_spf.google.com include:sendgrid.net ~all

For SendGrid, use the exact value SendGrid shows in your own account, or include:sendgrid.net.

7. Two SPF records on one domain

Adding a new service often means pasting a second v=spf1 TXT record instead of editing the first. With two records, receivers return permerror for every message (RFC 7208, section 4.5). Fix: merge the mechanisms into one record and delete the other.

v=spf1 include:_spf.google.com ~all
v=spf1 include:servers.mcsv.net ~all
v=spf1 include:_spf.google.com include:servers.mcsv.net ~all