Finding: SPF Policy Delegated With redirect=
This is an informational finding, not a problem by itself. It means your domain's SPF record delegates its policy to another domain with a redirect= modifier — the effective policy is whatever that other domain publishes.
Last updated August 11, 2026.
What it means
Instead of listing its own senders and a final all mechanism, a record using redirect=points receivers at a different domain's SPF record and asks them to evaluate that one instead. This is a legitimate SPF feature, commonly used by organizations that manage SPF centrally for many domains from one shared record.
Why it matters
Because the actual policy lives on the redirect target, not on your own record, Nivaronix cannot state whether your domain's effective SPF policy is strict or weak without also checking that other domain. This scan does not follow the redirect, so this finding makes no claim either way — it only tells you the delegation exists so you know where to look next.
What Nivaronix checks
Nivaronix performs a live TXT lookup, isolates the single record beginning with v=spf1, and looks for a redirect= modifier. This finding fires when one is present.
Example evidence (illustrative — not live scan data)
TXT example.com: v=spf1 redirect=_spf.parentcompany.com
How to fix it
There is nothing to fix on this record by itself — but confirm the delegation actually protects you:
- Look up the SPF record on the domain named in
redirect=directly (a TXT lookup on that domain, or the SPF & DMARC checker pointed at it). - Confirm that record ends in
-alland lists every server that actually sends mail for your domain. - If the redirect target changes ownership or configuration, re-check — your domain's effective policy changes with it, without any edit to your own record.
How to verify
Run the SPF & DMARC checker against the redirect target domain to see its own final policy directly.