I'm working on optimizing our SPF record to fix email deliverability issues. We’ve had 5x the number of undelivered emails in June, July, and August, which coincides with issues I've seen other users raise both here in the forums and on Reddit. We send out about 7500 emails with invoices per month and average ~50 rejections. That number has risen to ~250 the last 3 months. Most errors are "Permanent Failure: Other undefined status".
I’ve gone through all the email troubleshooting and our initial DKIM, DMARC, and SPF checks all pass. However, one SPF testing tool I was using mentioned 5 NetSuite subdomains related to “include:sent-via.netsuite.com” were pushing above the 10-lookup SPF limit when combined with other domains are company uses. I'm guessing this is maybe causing the issues?
Is “include:sent-via.netsuite.com” too broad?
When I add include:sent-via.netsuite.com to our SPF record, it triggers a cascade of additional DNS lookups:
- sent-via.netsuite.com points to rp.oracleemaildelivery.com
- rp.oracleemaildelivery.com then includes 4 regional subdomains:
- 1amer.rp.oracleemaildelivery.com (North America)
- eu.rp.oracleemaildelivery.com (Europe)
- ap.rp.oracleemaildelivery.com (Asia-Pacific)
- plus the base domain IPs
This single include:sent-via.netsuite.com entry consumes 5 DNS lookups, which pushes us over the 10-lookup SPF limit and causes our emails to fail SPF validation.
My Proposed Solution
Looking at our email headers, I can see that our NetSuite emails are consistently being sent from:
- Datacenter: phx1.rp.oracleemaildelivery.com (Phoenix)
- IP Range: 192.29.103.x
Since we're only sending emails from/to North America, I'd like to replace include:sent-via.netsuite.com with a more specific include like include:phx1.rp.oracleemaildelivery.com to reduce our DNS lookup count.
My Questions
- Does NetSuite lock accounts to a specific datacenter for email delivery? Or could my emails potentially route through different datacenters (phx1, phx2, other US datacenters, etc.)?
- Is it safe to use a datacenter-specific SPF include (like phx1.rp.oracleemaildelivery.com), or should I expect failover/load balancing across multiple datacenters?
- Has anyone else successfully solved the SPF lookup limit issue with NetSuite by using a regional or datacenter-specific include instead of the broad sent-via.netsuite.com?
Additional Context
- Our NetSuite account is based in North America
- All our recipients are in North America
- I've checked headers from invoice emails and they all show phx1
Any insights or experiences would be greatly appreciated! I want to make sure I don't break email delivery by being too specific with the SPF record.
Thanks in advance!
