yodai Academy Domain and email

Academy › Publishing › Domain and email

The permission you gave your website doesn't cover your invoices

The permission you gave your website doesn't cover your invoice

By Yodai · Published September 6, 2026 · Updated October 12, 2026

5 min read

You gave your domain permission to send email from your website: the contact form notice goes through fine, the newsletter goes through fine. But the day you turn on automatic booking confirmations, or PDF invoice delivery, those emails get stuck in spam or don't arrive at all.

It's the same domain and the same sender name you've been using for months. The difference is that those two new tools weren't listed as who's allowed to speak on your behalf, the list you wrote down when you set up your domain. Now you need to decide what to add to that list without breaking what already works.

The permission works like a list, not a switch

That permission has a technical name, SPF, and it lives in one very specific place: a TXT record inside your domain's settings, the same panel where you point your domain to your website. It's not an email switch you flip on, it's a list of services allowed to send email on your behalf.

When you first set up your email, whether with Google, Microsoft, or anyone else, that list usually ended up with just one entry: the service you use to write emails yourself. Anything not on that list, even if it uses your domain, gets sent without permission. The servers receiving the email notice right away and treat it with suspicion, even if the content is perfectly fine.

Many tools that send email on your behalf ask you to add their own line to that list. The booking confirmation, the invoice, the appointment reminder: if each one comes from a different tool, each one is a different sender that needs its own written permission.

What's written today, and what needs to be there
Before, with just one permission for your email: v=spf1 include:_spf.google.com ~all After, with the booking and the invoice now authorized: v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org ~all One single record, one long line: each "include" is one more service with permission to send as you.

The limit that shows up nowhere

Each "include" you add forces the receiving server to make an extra lookup to check that service. That kind of lookup has a hard limit: ten total every time your SPF gets checked, counting every "include," the ones nested inside each of those, and any other similar mechanism you might have written on the same line.

If you go over ten, it's not just the extra permission that fails. The entire record fails, all at once. A miscounted permission doesn't just let through less email: it casts suspicion over your whole domain, including the email that had been delivering fine for months.

Pasting each instruction as it comes in
Every new tool (bookings, invoicing, a form, an email reminder service) comes with its own "add this to your SPF" instructions. Pasting them in one after another without counting how many you already have is the fastest way to go over ten without noticing. There's no warning on screen: one day the usual email, the one that never used to fail, starts landing in spam, and nobody knows why.
What to add today, and in what order
  1. 1Make a list of who sends email on your behalf
    Your website's contact form, your booking tool, your invoicing software, and any marketing tool you already use. Count only the ones that send email from an @yourdomain.com address, not the ones that just show a button or a payment link.
  2. 2Count what's already there
    Open your current SPF record, in the same place where you manage your domain, and count how many "include" entries it already has. Keep in mind: each one can have others nested inside, and those count too; a free SPF checker will give you the total number of lookups. That number is your starting point, not zero.
  3. 3Add only what actually sends email
    Each tool on your list usually gives you its own "include:something.com" line in its help docs. Copy it exactly as is, into the same record you already have, never into a new one.
  4. 4If you're getting close to ten, trim before adding more
    Remove from the list any includes for tools you no longer use or that never actually sent real email. If you're still over, check whether the provider offers a combined include that replaces several separate ones.
  5. 5Keep a single TXT record, not two
    A domain can only have one SPF record. If you check and find two, merge them into one, with a single "v=spf1" at the start and a single ending.
Paste the line as-is, or count before touching your DNS
Paste each include as it comes in
  • Done in a minute, without opening the whole record
  • Works fine as long as you're far from the limit of ten
  • Doesn't require reviewing what you already had written
Count before touching your DNS
  • You know how many lookups you have left before writing anything
  • You also catch includes for tools you no longer use
  • You avoid a silent failure knocking out email that had been working fine for a while

Which to choose: Paste the line as is only if you're sure you're nowhere near the ten-lookup limit, counting the ones nested inside each include too. If you're not sure, count first: the failure doesn't show any warning on screen, and when it hits, it affects your whole domain, not just the new tool.

What you'll walk away with
  • You know where your domain's permission lives, and that it's a list, not a switch
  • You've counted the lookups your SPF record uses today, including the ones nested inside each "include"
  • Booking and invoicing get added to that list without going over ten
  • Your domain has a single SPF record, not two separate ones
  • Up next: why you can't sign everything you send with the same name
NextWhy you can't use the same signature for everything you send