220-1101 Question 116
Single answerSender Policy Framework (SPF)A small company recently moved its marketing email to a third-party service while keeping employee email on its Microsoft 365 tenant. After the change, many customer replies indicate that promotional messages are landing in spam or being rejected with errors referencing SPF. You review the DNS zone and see that the domain already has an SPF TXT record authorizing Microsoft 365 mail servers, but nothing for the marketing provider. Which action should the technician take FIRST to address the SPF-related delivery problem without disrupting normal employee email?
- A
Update the existing SPF TXT record to include the marketing provider's authorized sending hosts along with Microsoft 365, ensuring there is still only one SPF record for the domain
- B
Create a second SPF TXT record for the marketing service so each mail platform has its own separate SPF policy
- C
Remove the Microsoft 365 entry from the SPF record and replace it with the marketing provider so promotional mail passes SPF
- D
Enable IMAP and SMTP AUTH for all user mailboxes so external servers can verify the domain more easily
Show answer and explanation
Correct answer: A
Explanation
SPF, or Sender Policy Framework, is a DNS-based email authentication method used to specify which mail servers are allowed to send email on behalf of a domain. In this scenario, the company added a new legitimate sending source, so the SPF record must be updated to include that provider in the existing SPF TXT record. A key best practice is to maintain one SPF record per domain and add all authorized senders within that single policy. Creating multiple SPF records is not recommended and can lead to SPF evaluation errors. Microsoft, Google, and the SPF specification guidance all emphasize proper DNS TXT record configuration and avoiding multiple SPF records. Although SPF helps receiving systems evaluate whether a sending host is authorized, it must be maintained whenever a company adds services such as cloud email, ticketing systems, or marketing platforms that send mail for the domain.
- A. Correct.
Correct. SPF works by publishing a TXT record in DNS that identifies which mail servers are permitted to send mail for a domain. If the company now uses both Microsoft 365 and a third-party marketing platform, the SPF record should authorize both sources in a single valid SPF record. This addresses the marketing messages failing SPF checks while preserving normal employee email delivery.
- B. Incorrect.
Incorrect. A common misconception is that each mail service should get its own SPF record. In practice, a domain must have only one SPF record. Publishing multiple SPF records can cause SPF PermError results at receiving mail systems, which can make deliverability worse rather than better.
- C. Incorrect.
Incorrect. Replacing Microsoft 365 with only the marketing provider might help promotional messages pass SPF, but it would likely cause employee email sent from Microsoft 365 to fail SPF checks. The scenario specifically requires fixing the issue without disrupting normal employee email.
- D. Incorrect.
Incorrect. IMAP and SMTP AUTH are mailbox access and client submission settings, not domain authentication controls for sender verification. They do not solve SPF validation failures at recipient mail systems. Someone might choose this if they confuse user mail protocols with DNS-based email authentication.