Your SPF and DKIM passed last month. Here is why they can fail today without you touching DNS

A one-time email authentication setup is a snapshot. The records you published can stay byte-for-byte identical while the result changes, because several parts of the check live outside your zone.

1. SPF includes are nested, and you do not control them

include: pulls in another domain's record, which can include more domains. SPF allows at most 10 DNS-querying mechanisms per evaluation (RFC 7208, section 4.6.4). If a provider you include adds an include of its own, your total can cross 10 with no edit on your side. The receiver then returns permerror and SPF fails.

Count yours recursively. Each include, a, mx, ptr, exists and redirect counts as one lookup, and so do the ones inside the included records:

dig +short TXT example.com
dig +short TXT _spf.provider.example

Repeat for every include you find. ip4, ip6 and all cost nothing.

2. DKIM selectors get rotated or retired

Providers that use CNAME-delegated selectors can rotate keys on their side. If a CNAME in your zone is deleted during a DNS cleanup, signing breaks silently:

dig +short CNAME selector1._domainkey.example.com
dig +short TXT selector1._domainkey.example.com

An empty answer for a selector you still sign with means mail from that sender will show dkim=fail or dkim=none.

3. A new sender appears

Marketing adds a newsletter tool, support adds a helpdesk. Neither is in SPF and neither signs with your domain. Under p=none nothing visibly breaks. The day the policy moves to quarantine or reject, that mail starts landing in spam or bouncing.

4. Read the evidence, do not guess

The aggregate reports sent to your rua= address list every source IP with its SPF and DKIM alignment result. A source you do not recognise, or a known one that suddenly shows fail, is the signal that something drifted.

What a healthy setup looks like

• SPF stays under 10 lookups with headroom, and is re-counted after any provider change.
• Every legitimate sender has either an aligned DKIM signature or an SPF-aligned envelope domain.
• Someone actually reads the aggregate reports on a schedule, before tightening the policy.

The checks are easy once. The failure mode is that nobody repeats them, which is why the same domain can be healthy in September and bouncing mail in November.