MX records vs SPF records: receiving routes and sending authorization

Define the decision

MX tells other mail systems where to deliver mail for a domain. SPF describes authorized sending infrastructure for the evaluated identity. A domain can receive through one service and send legitimate mail through several others.

Work through the procedure

1. Classify the symptom: incoming mail missing, outbound authentication failing or both.
2. Inspect MX for the incoming domain and SPF for the actual envelope domain.
3. Map each record to its service owner.
4. Test the affected direction after changing only the responsible configuration.

Worked example

The following is a synthetic example for this procedure, not a customer result or performance benchmark.

Inbound support replies: routed by example.com MX
Outbound invoices: sent by a separate authorized service
Fault: invoice SPF fails
Unrelated change to avoid: replacing the support mailbox MX

Read the result

The direction of the failure determines the relevant evidence. A mail-exchange record does not automatically authorize every server behind that service to send under every domain identity.

Check before moving on

1. Use controlled incoming and outgoing tests separately.
2. Record the envelope domain from a received message.

Limits and next action

DNS terms often appear together in setup screens, but they serve different purposes. Preserve unrelated mail routing while correcting authentication.

Source: Cloudflare: email DNS record roles