Writing anSPF record.
The record itself is one line of TXT. What trips people is which services to include, and the limits nobody mentions until they bite.
What is usually wrong
There is more than one SPF record
A domain gets exactly one. Adding a fresh TXT line for each new service produces a permanent error, and receivers stop evaluating SPF altogether. Merge the includes into a single record.
You are past ten DNS lookups
Evaluating SPF costs DNS lookups, and the ceiling is ten. Stack up includes, a and mx and you cross it — after which SPF simply fails. Nothing warns you; mail just stops authenticating.
A sending service is missing from the record
Everything that sends as your domain needs an include: marketing mail, the contact form, invoicing, the booking system. Miss one and only that service's mail fails, which makes it hard to spot.
You have not decided between ~all and -all
~all means probably-not-us: accepted but suspected. -all means definitely-not-us and may be refused outright. Going straight to -all silently deletes mail from any service you forgot. Start with ~all.
Two ways out
Write it yourself
One TXT record on the domain: start with v=spf1, list the includes for what you actually send through, close with ~all. Then resolve it for real — published and working are not the same thing, and propagation takes time.
Take form mail out of scope
For the contact form specifically, mail can leave without claiming your domain at all: the sending platform is the From, your address is the Reply-To. SPF stays untouched and form mail still arrives.
Start freeOne line to install, nothing published on your DNS. Submissions come back sorted, with a reply already drafted.
<script src="https://nintact.com/embed.js"
data-nintact="YOUR_FORM_ID" async></script>Questions
Is SPF alone enough to get delivered?
It stops outright rejection for being unauthenticated. Staying out of the spam folder reliably also wants DKIM, and bulk senders are expected to publish DMARC.
How many includes can I have?
The limit is ten DNS lookups, not ten includes. A single include can consume several on its own, so three or four can already be close to the ceiling.
How long does it take to apply?
Minutes to hours, occasionally most of a day. Do not consider it done until you have resolved the record and seen the new value.
What if I cannot edit the DNS?
For form mail you can work around it entirely — see the page on sending form email when you cannot edit the DNS.