SPF for Agencies

You manage websites, DNS, and marketing campaigns for clients. But are you managing their email authentication?

When a client's email starts landing in spam—or worse, gets rejected entirely—you're often the first call. Even if it's not technically your responsibility, protecting client email deliverability is good business.

The Agency Email Problem

Your clients use multiple services that send email:

Their email provider (Google Workspace, Microsoft 365)
Marketing automation (HubSpot, Mailchimp, ActiveCampaign)
CRM systems (Salesforce, Zoho)
Support tools (Zendesk, Intercom, Freshdesk)
E-commerce platforms (Shopify, WooCommerce)
Your own tools sending on their behalf

Each of these needs to be in the client's SPF record. Miss one, and those emails may fail authentication.

The question you don't want to get

"Why are our marketing emails going to spam?" is a question that leads to hours of troubleshooting. Proper SPF setup prevents it.

Why Agencies Should Care About SPF

Client success depends on email

Your clients' businesses run on email:

Marketing campaigns drive revenue
Transactional emails confirm purchases
Support replies maintain relationships
Newsletters build engagement

When email breaks, business suffers. And you're associated with that failure.

SPF issues reflect on you

Even if you don't manage email directly, DNS often falls under your scope. When email deliverability problems trace back to misconfigured DNS records, that's your domain (literally).

Proactive management builds trust

Clients notice when you catch problems before they do. Managing SPF proactively positions you as thorough and professional.

Quick SPF Check for Client Domains

Start by understanding the current state of your clients' SPF records.

Common Agency Scenarios

New client onboarding

When you take on a new client:

Check their existing SPF record

Do they have one? Is it valid? How many DNS lookups does it use?

Identify all email-sending services

Document every service that sends email for their domain.

Verify all services are in SPF

Each service needs to be authorized in the SPF record.

Document the configuration

Add to your client file for future reference.

Adding a new marketing tool

Client wants to add Mailchimp to their stack:

Get Mailchimp's SPF include requirement
Check current SPF lookup count (is there room?)
Add the include to their SPF record
Verify the change propagated correctly
Test by sending a campaign and checking headers

Troubleshooting deliverability issues

Client reports emails going to spam:

Check SPF record for errors or missing services
Verify DNS lookup count isn't exceeded
Check DKIM and DMARC configuration
Review MX records for issues

The 10 Lookup Limit Challenge

Agencies often run into the SPF 10 DNS lookup limit when clients use many email services. With each service requiring 1-4 lookups, limits get hit fast.

Typical client stack:

Google Workspace: 3-4 lookups
Mailchimp: 1-2 lookups
SendGrid: 1-2 lookups
Salesforce: 2-3 lookups
Total: 7-11 lookups

Solutions:

Remove unused includes from old services
Use IP addresses where possible (for stable IPs)
Consider SPF flattening for complex configurations
Split email across subdomains if necessary

See our guide on the SPF 10 DNS lookup limit.

Building SPF Into Your Workflow

Onboarding checklist addition

Add to your new client checklist:

[ ] Check SPF record exists and is valid
[ ] Document current SPF configuration
[ ] Verify all email services are included
[ ] Check DKIM and DMARC status
[ ] Add domain to monitoring

Before adding email tools

Before setting up any new email service for a client:

[ ] Get SPF/DKIM requirements from the service
[ ] Check current lookup count
[ ] Update SPF record
[ ] Verify propagation
[ ] Test authentication

Quarterly audits

Review client email authentication quarterly:

Are all services still in use?
Have any services changed their SPF requirements?
Are there new tools that need to be added?
Has the lookup count changed?

Billing for Email Authentication Management

Some agencies include SPF management in retainers. Others treat it as a separate service:

Approach	Example
Bundled	Email deliverability maintenance included in hosting package
Project	$200 one-time email authentication setup and documentation
Retainer add-on	$50/month email authentication monitoring and management

The value proposition: preventing deliverability disasters saves clients significant revenue and saves you emergency support time.

Client Education

Help clients understand why this matters:

For non-technical clients: "SPF is like a guest list for email. It tells other email servers which services are allowed to send email using your domain. Without it, your emails may go to spam or be rejected entirely."

For technical clients: "SPF validates the sending server against authorized sources in DNS. Combined with DKIM and DMARC, it protects your sender reputation and ensures deliverability."

Agency-Friendly Monitoring

One-time checks catch issues at setup. Ongoing monitoring catches changes and problems over time.

The Email Deliverability Suite lets you:

Monitor multiple client domains from one dashboard
Get alerts when SPF records change or break
Track DKIM, DMARC, and MX alongside SPF
Share reports with clients

Monitor client email authentication

Track SPF, DKIM, DMARC, and MX records for all your clients. Get alerts when something breaks.

Start Monitoring

SPF Management for Digital Agencies