Nobody opens a ticket for an SPF record. There is no alert, no dashboard turning red, no user calling to say that an IP address from a provider the company stopped paying two years ago is still authorized to send email on its behalf.
That is exactly what makes it dangerous.
I audited the SPF record of a mid-sized manufacturing company in Brazil and found authorized senders that had not been part of the environment for years. Nothing was broken. Email was flowing normally. And that is the point — a bloated SPF record does not fail loudly. It fails quietly, on the day someone decides to use it.
The problem
The company had migrated its email to Microsoft 365. The migration itself went fine — mailboxes moved, mail flow worked, users were happy, project closed.
