MailFixIt

Infomaniak kSuite email configuration guide

Infomaniak kSuite: SPF record for provider sending

The envelope domain used by a kSuite message may not authorize Infomaniak in its effective SPF policy.

Problem description

A provider setup symptom may look like:

SPF record for provider sending after a provider DNS change.

Check the sending domain

What this usually means

The domain checked by SPF does not authorize the kSuite sending path, or the DNS name contains more than one SPF record.

Fix it

  1. Confirm in Infomaniak Manager that this domain and Mail Service are the route that sent the message.
  2. Read the message header to identify the envelope MAIL FROM domain; it may differ from the visible From address.
  3. Copy Infomaniak’s current SPF mechanism for that service and find the one TXT record beginning with v=spf1 at the envelope domain.
  4. Merge the mechanism into that policy while preserving every other service that still sends legitimate mail.
  5. Publish it, send a new message, and confirm spf=pass for the expected domain and IP.

Common mistake

A second SPF record does not extend the first one; it causes SPF to return a permanent error. Do not remove other senders until you know they are retired.

What MailFixIt can check

MailFixIt can trace the public SPF policy and its dependencies. It cannot discover private sending applications that are absent from DNS and the supplied headers.

Use the related SPF guides for a failing include, wrong envelope subdomain, or lookup-limit problem.

Frequently asked questions

What does MailFixIt check for Infomaniak kSuite?

It can detect duplicate SPF records, syntax errors, failed dependencies, and visible IP authorization. A new message header is needed to prove the evaluated domain and result.

Should I replace every existing DNS record with the provider values?

No. Confirm the exact record type and owner, preserve unrelated legitimate services, and change only the provider-controlled record required for the intended mail route.

Related email diagnostics

Email delivery delayed or rejected after a DNS migrationDiagnose email that stopped arriving after a DNS change. Compare public MX records with the intended provider and avoid false alarms for mail gateways. SPF is not configured for the envelope sender domainDiagnose SPF missing on a bounce or MAIL FROM subdomain. Check the exact envelope domain, add only authorized senders, and verify safely. DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key.

Primary sources: Infomaniak kSuite official setup guidance.