Fix your SPF record

What SPF allows

SPF lists the servers that may send mail with an envelope sender at example.com. It is one TXT record, and these rules apply to it:

1. Publish one SPF record per name. Two records at example.com make SPF return an error for all your mail. To merge them, keep one v=spf1 at the start and one all at the end.
2. Start the record with v=spf1.
3. Keep it to 10 DNS lookups or fewer. Each include, a, mx, ptr, exists and redirect costs one lookup, and the lookups inside an include count too. The lookup tree on Mailmoni's DNS tab counts them for you. With more than 10, SPF returns an error and DMARC counts SPF as failing.
4. End it with ~all or -all. Never use +all, which allows every server on the internet to send as example.com.
5. Do not use ptr. RFC 7208 asks you not to publish it, because it is slow and unreliable.

This record allows one sending service and one server address:

v=spf1 include:spf.example.net ip4:192.0.2.10 ~all

To get under 10 lookups, remove the includes of services you no longer use. On Mailmoni's DNS tab, each include is named after the service behind it. You can also ask a service whether it offers a smaller include.

SPF aligns for DMARC only when the envelope sender's domain is example.com or a subdomain of it. Many services use their own domain there, so their mail passes SPF but does not align. That is why a custom bounce domain in the service matters. The guide on setting up DKIM for a sending service shows how to add one.

Check it worked

Press Check now on Mailmoni's DNS tab. The SPF card shows no problem, and the lookup tree counts 10 lookups or fewer. Reports from the next 24 to 48 hours show the new SPF results.