Unable to verify SPF record for Azure Email Comms

Question

Azure Email Comms is refusing to verify my domain's SPF record, but it is not telling me exactly what is wrong with it. I have used CoPilot to get some clues and adjusted my SPF record accordingly but Azure Email Comms still refuses to verify. Here is my SPF record:

v=spf1 ip4:20.90.138.231 ip4:40.92.0.0/15 ip4:185.19.19.208/28 ip4:62.233.124.16/28 include:_spf.glasgow.gov.uk include:spf.mailanyone.net a:glasgow.gov.uk.outbound1-uk.mailanyone.net a:glasgow.gov.uk.outbound2-uk.mailanyone.net a:glasgow.gov.uk.outbound3-uk.mailanyone.net ~all

Answer 1

Hi Gerard Callaghan,

To fix the issue, Lets follow these steps:

1. DNS Lookup Limit: Although MXToolbox shows the record is green, Azure may still not be passing the SPF verification if it has hit the DNS lookup limit. Even though you’ve replaced some include mechanisms with ip4 entries, it’s important to verify the overall number of DNS lookups is within the 10-lookup limit. This includes checking any indirect includes or a-record lookups in the services you have listed (like spf.mailanyone.net and _spf.glasgow.gov.uk).
2. Flatten the Includes: While you has already adjusted by adding ip4 entries, a key next step is verifying if other included domains like spf.mailanyone.net or glasgow.gov.uk may also require you to add their exact IP ranges directly (flattening the record). Flattening the SPF record means no more include statements that cause DNS lookups. You can use tools like MXToolbox to find the actual IP ranges of the domains included in your SPF record and replace the include statements with those IP ranges.
3. Azure-specific behavior: It’s possible that Azure’s email verification system has stricter checks beyond DNS lookups. The “could not be verified” error in the Azure portal might also be caused by factors like: DNS propagation: Changes to the SPF record might not have fully propagated across DNS servers. Azure-specific limits or caching: Azure might cache the result, so ensure you're testing the verification after DNS changes have propagated.
4. Check for SPF Record Length: Ensure that the SPF record doesn’t exceed the maximum length of 255 characters. If it does, you may need to split it across multiple records or reconsider which parts to include.

Next Steps: 

1.Flatten the include mechanisms: Replace include:_spf.glasgow.gov.uk and include:spf.mailanyone.net with their actual IP ranges. This will help reduce lookups and might solve the issue with Azure.

2.Test again in Azure: Once you’ve flattened the record and adjusted the includes, check again in the Azure portal to see if the verification passes.

3.Verify DNS Propagation: Ensure that the updated SPF record has fully propagated across all DNS servers. You can use tools like DNSstuff to confirm this.

For reference- 

https://learn.microsoft.com/en-us/azure/communication-services/concepts/email/email-domain-and-sender-authentication?

https://learn.microsoft.com/en-us/azure/communication-services/concepts/email/email-domain-configuration-troubleshooting?

https://learn.microsoft.com/en-us/azure/communication-services/quickstarts/email/add-custom-verified-domains?pivots=platform-azp

If you have any further assistant, do let me know.

Answer 2

Yes, MXToolBox is all green for the PSF record and when I look at the domain in the Azure Portal's Email Comms page, it shows that the SPF "could not be verified" but no detail as to why. Using CoPilot, I was told there were too many "includes" so I added the "ip4" directly. CoPilot also suggested that the issue may be the "soft fail" "~all" command but we need soft fail.