MailFixIt

STRATO Mail email configuration guide

STRATO Mail: SPF record for provider sending

The SPF policy may not authorize the system that sent the message, or the message may use an envelope domain different from its visible From address.

Problem description

A provider setup symptom may look like:

SPF record for provider sending after a provider DNS change.

Check the sending domain

What this usually means

The SPF policy at the envelope domain does not authorize the actual STRATO or third-party sending route, or more than one SPF record makes evaluation invalid.

Fix it

  1. Inspect a new message header and identify the envelope MAIL FROM domain plus sending IP.
  2. Confirm whether the message used STRATO SMTP, a STRATO-hosted website, or another email provider.
  3. Obtain the current SPF mechanism from each active sender and keep one TXT policy beginning with v=spf1 at the envelope domain.
  4. Merge the mechanisms without removing a legitimate website, CRM, or newsletter service.
  5. Publish the policy and confirm spf=pass in a new message through the same route.

Common mistake

Mail sent from a website may not use the same server as a STRATO mailbox. A generic STRATO SPF value cannot authorize a third-party platform, and a second SPF record breaks evaluation.

What MailFixIt can check

MailFixIt can trace the public SPF policy. It cannot inventory private senders that are missing from the supplied message and DNS.

Use the related SPF guide for duplicate records, failed includes, or an unexpected subdomain.

Frequently asked questions

What does MailFixIt check for STRATO Mail?

It can detect duplicate SPF records, syntax failures, dependency errors, and public authorization. A message header is needed to identify the evaluated envelope domain and IP.

Should I replace every existing DNS record with the provider values?

No. Confirm the exact record type and owner, preserve unrelated legitimate services, and change only the provider-controlled record required for the intended mail route.

Related email diagnostics

Email delivery delayed or rejected after a DNS migrationDiagnose email that stopped arriving after a DNS change. Compare public MX records with the intended provider and avoid false alarms for mail gateways. SPF is not configured for the envelope sender domainDiagnose SPF missing on a bounce or MAIL FROM subdomain. Check the exact envelope domain, add only authorized senders, and verify safely. DKIM public key record is invalid or revokedDiagnose an invalid or revoked DKIM public key record. Check the exact DKIM selector in public DNS before replacing a sender-provided key.

Primary sources: STRATO Mail official setup guidance.