MailFixIt

Fastmail email configuration guide

Fastmail: SPF record for provider sending

Keep one SPF record and make sure it authorizes Fastmail plus every other service that sends mail for the same envelope domain.

Problem description

A provider setup symptom may look like:

SPF record for provider sending after a provider DNS change.

Check the sending domain

What this usually means

Fastmail may send the message, but the domain’s SPF policy does not authorize Fastmail for the envelope sender that receivers actually checked. SPF does not control incoming mail.

Fix it

  1. Confirm the envelope domain in a recent message header; it can differ from the visible From address.
  2. In Fastmail’s current custom-domain instructions, copy the SPF mechanism required for that domain.
  3. Find the existing TXT record that starts with v=spf1. There must be only one SPF record at that name.
  4. Add Fastmail to that record while preserving every other service that still sends legitimate mail.
  5. Publish the merged record, then send a new test and confirm spf=pass in the received headers.

Common mistakes

Do not publish a second SPF record and do not replace the policy until you know every active sender. Either mistake can break mail that was already passing.

What MailFixIt can check

MailFixIt can follow the public SPF policy, detect duplicates and syntax problems, and show which addresses it authorizes. It cannot identify an unlisted business application without a message header or sending inventory.

Use the related SPF guides to inspect the evaluated envelope domain and any failing include path.

Frequently asked questions

What does MailFixIt check for Fastmail?

It can find duplicate SPF records, syntax errors, lookup failures, and visible authorization paths. A message header is still needed to prove which envelope domain and IP were evaluated.

Should I replace every existing DNS record with the provider values?

No. Confirm the exact record type and owner, preserve unrelated legitimate services, and change only the provider-controlled record required for the intended mail route.

Related email diagnostics

Email delivery delayed or rejected after a DNS migrationDiagnose email that stopped arriving after a DNS change. Compare public MX records with the intended provider and avoid false alarms for mail gateways. SPF is not configured for the envelope sender domainDiagnose SPF missing on a bounce or MAIL FROM subdomain. Check the exact envelope domain, add only authorized senders, and verify safely. DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key.

Primary sources: Fastmail official setup guidance.