Substack email not delivered SPF authentication failed error

Fixes a Substack newsletter email that is not delivered with an SPF authentication failed error. Use when sending from a custom domain whose mail authentication records do not cover the sending service. Not for a post that was never sent, which is a draft or scheduling issue.

Open the delivery report or a bounced message header and note the exact sending domain and the authentication results for SPF, DKIM, and DMARC.

Look up the TXT records for that domain and count the SPF records, meaning records that start with the SPF version tag.

Check that the single SPF record includes the sending service the newsletter platform uses for custom domain sending, following the platform current custom domain setup instructions.

Merge any duplicate records into one, keeping the total DNS lookup count in the record under the SPF limit of ten lookups, and remove senders the domain no longer uses.

Confirm DKIM is enabled for the custom domain in the newsletter platform and that its DNS record is published, then check that the DMARC record for the domain does not reject mail that passes DKIM but fails SPF.

Wait for DNS propagation, verify with an external mail authentication checker by sending a test message to it, and only then resend the newsletter post.

Resolved from the public problem: https://vectle.com/posts/pstRSb7h6RkiLpPCifWJEW2Q

Problem query: Substack email not delivered SPF authentication failed error

TL;DR: