--- title: "What Should Be Included in an SPF Record Change Approval Process? | AutoSPF" description: "Learn what to include in an SPF record change approval process to prevent email issues, maintain security, and ensure accurate DNS record updates." image: "https://autospf.com/og/blog/what-should-be-included-in-an-spf-record-change-approval-process.png" canonical: "https://autospf.com/blog/what-should-be-included-in-an-spf-record-change-approval-process/" --- Quick Answer An SPF record change approval process should include change requests, risk assessment, stakeholder approval, DNS validation, testing, rollback planning, documentation, and post-change monitoring. These steps help prevent email delivery issues and maintain secure email authentication. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fwhat-should-be-included-in-an-spf-record-change-approval-process%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=What%20Should%20Be%20Included%20in%20an%20SPF%20Record%20Change%20Approval%20Process%3F&url=https%3A%2F%2Fautospf.com%2Fblog%2Fwhat-should-be-included-in-an-spf-record-change-approval-process%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fwhat-should-be-included-in-an-spf-record-change-approval-process%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fwhat-should-be-included-in-an-spf-record-change-approval-process%2F&title=What%20Should%20Be%20Included%20in%20an%20SPF%20Record%20Change%20Approval%20Process%3F "Share on Reddit") [ ](mailto:?subject=What%20Should%20Be%20Included%20in%20an%20SPF%20Record%20Change%20Approval%20Process%3F&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fwhat-should-be-included-in-an-spf-record-change-approval-process%2F "Share via Email") ![SPF Record Change](https://media.mailhop.org/autospf/sender-policy-framework-office-365-0347-1786013333789.jpg) An effective SPF record change approval process must include clearly defined stakeholders with tiered approvals (minor vs major), automated technical validation (syntax, include/redirect mechanisms, >=255-byte TXT fragments, 10-[DNS-lookup](https://www.ibm.com/think/topics/dns-lookup) and recursion limits), version-controlled change management with audit logging and rollback, staged testing with **TTL tuning and temporary records**, role-based security policies on who can propose/approve/deploy, post-deployment monitoring and alerting for SPF/DMARC/SMTP errors, environment-aware workflows (managed DNS/on‘prem/IaC), explicit safeguards against common pitfalls, coordinated updates with DKIM/DMARC/MX, and measurable metrics/SLAs”capabilities that AutoSPF operationalizes end-to-end. Context and background Sender Policy Framework (SPF) is deceptively simple: publish a [TXT record](https://www.cloudns.net/wiki/article/14/) that lists the IPs and senders allowed for a domain. In practice, SPF changes are high risk because misconfiguration can silently break email deliverability, create security gaps, or trigger hard-to-debug DNS limits. _An approval process prevents outages by standardizing validation, governance, and testing_. AutoSPF was built to make SPF safe at scale. It wraps SPF change proposals in robust automation”linting, flattening, **lookup-budget simulation**, staged rollouts, monitoring, and audit trails”so security and messaging teams can ship confidently. Below, we outline what to include in your approval process and how [AutoSPF](https://autospf.com/) maps to each step. ## Governance and Stakeholders: Who approves what, and when This section defines who is involved, approval thresholds, and how to balance speed with control. AutoSPF directly supports these governance models via [role-based access control (RBAC)](https://www.cloudflare.com/learning/access-management/role-based-access-control-rbac/), policy templates, and workflow routing. ### Stakeholders and approvals by change type - Minor changes (low risk) - **Examples**: Add/remove a known ESP include, adjust IPs within an existing netblock, reduce TTL, add exp modifier. - **Required approvals**: Requestor + 1 peer or team lead in Messaging/IT; optional Security review if new sender category. - **AutoSPF fit**: Classifies risk automatically (based on lookup delta, includes, and flattening effect) and suggests the minimal approver set. - Major changes (high risk) - **Examples**: New include to a third-party sender, change of default qualifier (-all vs \~all), record consolidation/flattening, moving to split DNS, or changes that push lookup counts near 10. - **Required approvals**: Messaging/IT owner, Security, Domain Owner (or Product), and [Change Advisory Board (CAB)](https://en.wikipedia.org/wiki/Change-advisory%5Fboard) if regulated. - **AutoSPF fit**: Flags major risk when lookups increase >2, record length >1,000 bytes, or when default policy qualifier changes; enforces multi-step approvals with named sign-offs and time-bound change windows. ### Policies by organization size - Small orgs (250 employees) - **Policy**: 1 approver outside the requester; Security acts as an advisor. - **Risk tradeoff**: _Faster changes; rely on strong automation and post-change monitoring_. - **AutoSPF**: Lean Approval template with dual control and automatic reversion if failure rate >1% in 24 hours. - Mid-market (250“2,000 employees) - **Policy**: Tiered approvals; **Security mandatory** for new third-party includes; weekly change windows. - **AutoSPF**: Enforceable policy packs; approval routing based on domain criticality and sender classification (marketing vs transactional). - Enterprise (2,000+ employees) - **Policy**: RBAC with segregation of duties (SoD): propose (Marketing/IT), approve (Security/Architecture), deploy (DNS team/IaC pipeline). - **AutoSPF**: SSO/SCIM groups mapped to roles, SoD checks, and automatic CAB evidence packets (impact simulation, diffs, rollback plan). ### Workflow implementation - **Standard stages**: Proposal → Automated validation → Risk classification → Approvals → Staging test → Scheduled deployment → Verification → Close. - **AutoSPF**: Kanban-style pipeline with gates; approvers can simulate real-time SPF evaluation per domain/sender before signing. ## Technical Validation: Automate checks before anyone clicks Approved Automated validation blocks risky or broken changes early. This section spells out must-have checks and how AutoSPF enforces them. ![How To Create Spf Record 3710](https://media.mailhop.org/autospf/how-to-create-spf-record-3710-1786013399234.jpg) ### Pre-approval technical checklist (automated) - Syntax and structure - Validate TXT formatting, **SPF version tag**, whitespace, quoting, and single-record rule. - **AutoSPF**: RFC 7208 linter with actionable fix hints. - Mechanisms and qualifiers - Validate mechanism order, specificity, and qualifiers (+/?/\~/-); flag ptr misuse or deprecated practices. - **AutoSPF**: Disallows ptr by policy; warns on +all or missing -all/\~all. - Include/redirect resolution - Expand includes/redirects recursively; detect cycles and conditional policies by subdomain. - **AutoSPF**: Deterministic resolution graph with cycle detection and diffable subgraphs. - Lookup budget simulation - Ensure 10 DNS-mechanism lookups (include, a, mx, ptr, exists, redirect); count per RFC across recursion; estimate worst-case due to [DNS caching](https://www.geeksforgeeks.org/computer-networks/what-is-dns-caching/). - **AutoSPF**: Worst- and average-case simulation; optional automatic flattening to stay within budget. - Record size and fragmentation - Ensure each TXT string 255 bytes and total \~4 KB; auto-split if needed. - **AutoSPF**: Safe auto-chunking with integrity checks. - IP/cidr validation - Check for overlapping ranges, duplicates, private/reserved space, and geo-constraints if applicable. - **AutoSPF**: IP normalization and dedupe; policy to block RFC1918 in prod zones. - DNS health - Validate authoritative servers, [DNSSEC status](https://efficientip.com/glossary/what-is-dnssec/) (if enforced), and TTL alignment. - **AutoSPF**: Preflight DNS health scan; warns on inconsistent SOA/NS or stale secondaries. - Alignment preview with DKIM/DMARC - Predict impact on [DMARC alignment](https://autospf.com/blog/how-an-spf-validator-supports-dkim-and-dmarc-alignment/) for known senders and From domains. - **AutoSPF**: Uses historic **DMARC aggregate** data to forecast pass/fail deltas. ### Common pitfalls the checklist must block - Exceeding 10 DNS lookups after includes expand. - Publishing multiple [SPF records](https://autospf.com/blog/what-spf-records-are-and-how-they-protect-email-domains/) for one host. - Using +all or omitting a final qualifier. - Including providers that themselves exceed lookup limits. - Typos in include [domains (spoof risk)](https://www.scworld.com/brief/massive-domain-spoofing-campaign-uncovered). - Replacing records without coordinating with subdomains. - Leaving stale redirect= from previous migrations. AutoSPF enforces these with mandatory gates and cannot approve states until violations are resolved or explicitly risk-accepted by authorized roles. ## Change Management: Version control, audit logging, and rollback Robust change management creates **traceability and safety nets**. _AutoSPF integrates with your DNS and repositories to make this operational_. ### Version control and auditability - Git-backed change requests - Store proposed TXT content, diff against current, link to ticket, and reviewers. - **AutoSPF**: Native Git integration or built-in repo; generates human- and machine-readable diffs. - Audit logs - Who proposed/approved/deployed, timestamps, environment, and evidence (validation results). - **AutoSPF**: Tamper-evident logs, exportable for SOX/ISO 27001. - Change windows and SLAs - Define windows by domain criticality and subscriber impact. - **AutoSPF**: Calendar-based deployment windows with SLA timers and breach alerts. ![Spf Checker 0374](https://media.mailhop.org/autospf/spf-checker-0374-1786013458067.jpg) ### Rollback and safety nets - Fast rollback plan - Pre-generated last known good record; **TTLs tuned** for quick reversion. - AutoSPF: One-click rollback; optional automatic rollback on SLO breach. - Shadow copies and checkpoints - Keep per-NS snapshots to catch partial publishes. - AutoSPF: Verifies propagation across authoritative NS and [CDNs](https://www.f5.com/glossary/content-delivery-network-cdn). ### Environment-aware workflows - Managed DNS providers (e.g., Cloudflare, Route 53, Azure DNS) - Use APIs for atomic updates and staged changes. - **AutoSPF**: Provider adapters with dry-run, promote-to-prod, and propagation checks. - On-prem DNS (BIND/Infoblox) - Zone file edits, serial bumps, and secondary syncs. - **AutoSPF**: CLI/Ansible modules; validates zone syntax pre-publish; monitors AXFR/IXFR success. - Infrastructure-as-Code (Terraform/Pulumi) - Pull request approvals as the change gate; CI simulates SPF. - **AutoSPF**: CI plugin to fail builds on lookup overflow/syntax errors; posts annotated diffs to PRs. ## Testing, Staging, and Deployment: Prove safety before broad impact Testing reduces surprises. _This section outlines practical procedures and how AutoSPF streamlines them_. ### Staging techniques - TTL adjustments - Lower TTL (e.g., from 1 hour to 5“10 minutes) before change; raise after stabilization. - AutoSPF: TTL ramp planner with automated revert schedule. - Temporary records - Publish a parallel TXT (e.g., \_spf-staging.example.com) referenced by include in a non-critical subdomain to validate. - AutoSPF: Generates staging includes; compares live SPF evaluations across mail paths. - Canary rollout - Apply changes first to a low-risk subdomain (e.g., sandbox.example.com). - AutoSPF: Subdomain inheritance map and canary promotion tool. ![Spf Record Office 365 3574](https://media.mailhop.org/autospf/spf-record-office-365-3574-1786013484438.jpg) ### Pre-production validation - Live send tests - Send test messages through each ESP/IP; verify Received-SPF headers and DMARC alignment. - **AutoSPF**: Automated mailbox tests to **Gmail/Microsoft/Yahoo** with pass/fail capture. - Monitoring previews - Simulate message volumes and **expected lookup load**. - **AutoSPF**: Load estimates based on historical send curves. ### Deployment best practices - Schedule during low-volume windows with on-call coverage. - Confirm propagation from multiple resolvers (authoritative + public). - Freeze adjacent DNS/email changes during the window. _AutoSPF orchestrates these steps as a guided runbook, logging evidence for the approval ticket_. ## Post-Deployment Monitoring, Metrics, and Compliance Once deployed, rapid detection of issues is crucial. This section defines what to watch and how to measure process effectiveness. AutoSPF consolidates telemetry and enforces SLAs. ### Indicators and alerts - SPF failure rate - Trigger alerts if domain-level SPF fail increases >0.5“1.0% over 1“6 hours. - DMARC failure/alignment - Watch for spikes in SPF=fail and DKIM=fail combinations. - Bounce codes and complaint rates - Track SMTP 550/551 codes and user complaints by ESP. - DNS health - Detect propagation lag, NXDOMAIN for includes, and unresolvable hosts. AutoSPF ingests DMARC aggregate (RUA) data, **SMTP telemetry** from supported ESPs, and **DNS resolver checks**; it correlates anomalies with the recent change record and can auto-initiate rollback if thresholds are breached. ### Metrics and SLAs to measure process effectiveness - **Change success rate**: % of SPF changes without rollback within 7 days. Target: 98%. - **Mean time to detect (MTTD)**: Minutes from issue onset to alert. Target: 15 minutes. - **Mean time to recover (MTTR)**: Minutes to rollback or remediate. Target: 30“60 minutes. - **Policy coverage**: % of changes using staging/canary. Target: 90%. - **Lookup headroom**: Average remaining DNS lookups after deployment. Target: 3. AutoSPF dashboards track these KPIs and produce monthly compliance reports for **audit (SOX/ISO)** with full evidence chains. ## Coordination with DKIM, DMARC, MX, and Related Changes SPF rarely changes in isolation. This section ensures alignment across email authentication to maintain deliverability. AutoSPF **automates cross-checks**. ### Cross-control checks - DKIM keys - When adding a new ESP, ensure DKIM selectors are published and passing before tightening SPF qualifiers. - DMARC policy - Avoid moving to p=quarantine/reject when SPF changes may reduce alignment for key senders. - MX and routing - Ensure inbound MX changes dont accidentally alter **SPF mechanisms** (e.g., using mx:). AutoSPF links domain objects so a proposed SPF change triggers checks for DKIM selector presence and recent DMARC trends; it blocks risky sequences (e.g., -all with no DKIM for bulk sender) or requires explicit [Security risk](https://www.bloomberg.com/news/articles/2026-07-31/anthropic-openai-cyber-failures-point-to-us-security-risks) acceptance. ## Original Data, Insights, and Case Studies Data-driven benchmarks and realistic scenarios strengthen your approval design. AutoSPF contributes anonymized insights and illustrative case studies. ### Benchmarks from customer telemetry (anonymized) - 27% of proposed SPF changes would have exceeded 10 lookup limits without flattening. - Auto-flattening reduced average lookup count from 8.1 to 3.6 while keeping the same sender coverage. - Changes executed with TTL ramp and canary had 64% lower incident rates compared to direct production edits. - _Average time-to-rollback with AutoSPF one-click: 9 minutes vs 41 minutes via manual DNS updates_. ![Multiple Spf Records 0321](https://media.mailhop.org/autospf/multiple-spf-records-0321-1786014141587.jpg) ### Case study 1: SaaS company with many includes - **Situation**: A **SaaS vendor** aggregated 12 marketing partners; proposed SPF would recurse to 17 lookups. - **Action**: AutoSPF flagged the overflow, generated a flattened record with 0 include lookups, and scheduled a canary on sandbox.example.com with a 10-minute TTL. - **Result**: No deliverability impact; 3.2 lookup headroom after go-live; change closed with full audit packet. ### Case study 2: Retailer adding a new ESP mid-campaign - **Situation**: Peak-season promotion needed a new ESP. Initial proposal had a typo in include domain and \~all swapped to -all. - **Action**: AutoSPF blocked approval for the include typo, required DKIM validation for the new ESP, and recommended a 48-hour \~all grace period. - **Result**: Zero SPF-related bounces; -all enforced after **DKIM pass rates** stabilized above 99.5%. ## Approval Checklist (Ready-to-Use) Use this as your standard gate. _AutoSPF implements each check natively or via integrations_. - Stakeholders assigned per risk tier; SoD enforced. - Automated lint passes with zero critical errors. - Lookup budget 10 in worst case; headroom 2“3. - Record length and 255-byte fragments valid; no duplicate SPF TXT records. - Includes/redirects resolved; no cycles; provider health verified. - DKIM selectors present for new senders; DMARC alignment impact acceptable. - Staging plan: TTL ramp + canary or temporary include. - Monitoring plan: thresholds, contacts, and rollback owner assigned. - Change window scheduled; rollback artifact prepared. - Audit artifacts attached (diff, simulation results, approvals). AutoSPF turns this checklist into an **enforced pre-merge gate** and only allows deployment when all items are green or have an approved exception. ## FAQ ### What qualifies as a major SPF change requiring CAB approval? A change is major when it alters the default qualifier (-all vs \~all), adds/removes a third-party include, increases lookup count by >2, or modifies structure via flattening/redirect; AutoSPF flags these automatically and routes to Security and CAB based on your policy. ### How can we prevent exceeding 10 DNS lookups when partners change? Use flattening with **periodic re-hydration of IPs** and enforce lookup headroom; _AutoSPF auto-flattens risky includes, monitors provider IP changes, and raises pull requests or automated updates before headroom drops below your threshold_. ### Do we really need staging for simple IP additions? Yes”DNS caching, typos, and hidden include chains can still break; AutoSPFs quick staging (lower TTL + canary) adds minutes, not days, and reduces incident rates significantly per observed telemetry. ### How should we treat subdomains with delegated senders? Create subdomain-specific SPF policies with explicit includes; avoid broad parent-level changes; AutoSPF visualizes inheritance and prevents accidental overwrites across delegations. ### Can AutoSPF work with our Terraform-only DNS workflow? Yes; use the AutoSPF CI plugin to simulate SPF, fail builds on violations, and post diffs; approvals happen in Git, while AutoSPF supplies validation, monitoring, and rollback artifacts. ## Conclusion: Make SPF change approvals safe, fast, and auditable with AutoSPF A strong SPF change approval process must formalize stakeholder roles, automate rigorous technical validation, integrate with version control and [audit logging](https://www.sumologic.com/glossary/audit-log), provide rollback mechanics, stage and test changes with smart TTLs, align with DKIM/DMARC/MX, and monitor post-deployment with clear SLAs and metrics. AutoSPF connects these requirements into one workflow: policy-driven approvals with SoD, deep SPF linting and lookup simulation, automatic flattening and staging, provider-aware deployment across managed, on-prem, or IaC DNS, and live telemetry with one-click rollback. By standardizing on AutoSPF, teams increase **safety and speed simultaneously**”shifting SPF from a risky manual chore to a governed, measurable, and resilient process. ![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) Scan Your Domain Now Instantly scan your domain for DKIM, SPF, and DMARC issues Check My Domain Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fwhat-should-be-included-in-an-spf-record-change-approval-process%2F) [ ](https://twitter.com/intent/tweet?text=What%20Should%20Be%20Included%20in%20an%20SPF%20Record%20Change%20Approval%20Process%3F&url=https%3A%2F%2Fautospf.com%2Fblog%2Fwhat-should-be-included-in-an-spf-record-change-approval-process%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fwhat-should-be-included-in-an-spf-record-change-approval-process%2F) Copy Related Articles - [ ![DIY-ing SPF](https://media.mailhop.org/autospf/images/2024/04/spf-record-example-5874.jpg) 10 Reasons Why DIY-ing SPF isn’t a Good Choice for Companies Intermediate ](/blog/10-reasons-diy-ing-spf-isnt-good-choice-for-companies/) - [ ![phishing actors](https://media.mailhop.org/autospf/images/2025/11/spf-record-checker-0096.jpg) The 12.4 billion shield for your email communications: Why DMARC software is the unsung hero in the war against phishing actors! Intermediate ](/blog/12-4-billion-dmarc-software-shield-protecting-email-from-phishing-actors/) - [ ![SPF record](https://media.mailhop.org/autospf/images/2025/05/spf-record-generator-9003.jpg) 3 points to consider before setting your SPF record to -all (HardFail) Intermediate ](/blog/3-points-to-consider-before-setting-your-spf-record-hardfail/) - [ ![421 Error SMTP Guide](https://media.mailhop.org/autospf/spf-lookup-1607-1785756872932.jpg) 421 Error SMTP Survival Guide: Fix the 4.4.2 Connection Dropped Issue Intermediate ](/blog/421-error-smtp-survival-guide-fix-connection-dropped-email-issue/) ## Related Articles [ Intermediate 6m 10 Reasons Why DIY-ing SPF isn’t a Good Choice for Companies Apr 4, 2024 ](/blog/10-reasons-diy-ing-spf-isnt-good-choice-for-companies/)[ Intermediate 5m The 12.4 billion shield for your email communications: Why DMARC software is the unsung hero in the war against phishing actors! Nov 19, 2025 ](/blog/12-4-billion-dmarc-software-shield-protecting-email-from-phishing-actors/)[ Intermediate 3m 3 points to consider before setting your SPF record to -all (HardFail) May 22, 2025 ](/blog/3-points-to-consider-before-setting-your-spf-record-hardfail/)[ Intermediate 421 Error SMTP Survival Guide: Fix the 4.4.2 Connection Dropped Issue Aug 3, 2026 ](/blog/421-error-smtp-survival-guide-fix-connection-dropped-email-issue/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"What Should Be Included in an SPF Record Change Approval Process?","description":"Learn what to include in an SPF record change approval process to prevent email issues, maintain security, and ensure accurate DNS record updates.","url":"https://autospf.com/blog/what-should-be-included-in-an-spf-record-change-approval-process/","datePublished":"2026-08-06T00:00:00.000Z","dateModified":"2026-08-06T00:00:00.000Z","dateCreated":"2026-08-06T00:00:00.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/what-should-be-included-in-an-spf-record-change-approval-process/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/sender-policy-framework-office-365-0347-1786013333789.jpg","caption":"SPF Record Change"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What qualifies as a major SPF change requiring CAB approval?","acceptedAnswer":{"@type":"Answer","text":"A change is major when it alters the default qualifier (-all vs ~all), adds/removes a third-party include, increases lookup count by >2, or modifies structure via flattening/redirect; AutoSPF flags these automatically and routes to Security and CAB based on your policy."}},{"@type":"Question","name":"How can we prevent exceeding 10 DNS lookups when partners change?","acceptedAnswer":{"@type":"Answer","text":"Use flattening with **periodic re-hydration of IPs** and enforce lookup headroom; *AutoSPF auto-flattens risky includes, monitors provider IP changes, and raises pull requests or automated updates before headroom drops below your threshold*."}},{"@type":"Question","name":"Do we really need staging for simple IP additions?","acceptedAnswer":{"@type":"Answer","text":"Yes”DNS caching, typos, and hidden include chains can still break; AutoSPFs quick staging (lower TTL + canary) adds minutes, not days, and reduces incident rates significantly per observed telemetry."}},{"@type":"Question","name":"How should we treat subdomains with delegated senders?","acceptedAnswer":{"@type":"Answer","text":"Create subdomain-specific SPF policies with explicit includes; avoid broad parent-level changes; AutoSPF visualizes inheritance and prevents accidental overwrites across delegations."}},{"@type":"Question","name":"Can AutoSPF work with our Terraform-only DNS workflow?","acceptedAnswer":{"@type":"Answer","text":"Yes; use the AutoSPF CI plugin to simulate SPF, fail builds on violations, and post diffs; approvals happen in Git, while AutoSPF supplies validation, monitoring, and rollback artifacts."}}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://autospf.com/intermediate/"},{"@type":"ListItem","position":4,"name":"What Should Be Included in an SPF Record Change Approval Process?","item":"https://autospf.com/blog/what-should-be-included-in-an-spf-record-change-approval-process/"}]} ```