Keeping records correct.
WHAT BREAKS AUTHENTICATION
Adding a new sending service without updating SPF Changing hosting or DNS without carrying records over DNS changes made carelessly A second SPF record added
THAT LAST ONE
Only one is permitted. A second invalidates both.
WHAT TO CHECK AFTER ANY DNS CHANGE
That SPF, DKIM and DMARC records are still present and correct.
WHAT TO CHECK AFTER MIGRATING HOSTING
The same. These records do not travel automatically.
That is a common cause of mail failing after a migration.
WHAT TO CHECK WHEN ADDING A SERVICE
Whether it needs including in SPF Whether it provides a DKIM record
WHAT TO REMOVE
Services no longer used, from your SPF record.
They consume lookups against the limit.
HOW OFTEN TO REVIEW
Annually, and after any change.
WHAT TO DOCUMENT
Which services send as your domain, and what each required.
