High SeveritySPF

Fix: No SPF Record Found

Your domain does not have an SPF TXT record published in DNS. Without SPF, receiving servers cannot verify which mail servers are authorized to send email on behalf of your domain.

Quick Fix

Add a TXT record to your domain's DNS with your SPF policy.

What This Error Means

No TXT record starting with "v=spf1" was found in your domain's DNS. This means there is no declared policy for which servers are allowed to send email as your domain. Receivers will return an SPF result of "none".

Why It Matters

Without SPF, anyone can send email claiming to be from your domain and there is no DNS-based mechanism for receivers to detect it. This makes your domain an easy target for spoofing and phishing. SPF is also required for DMARC alignment.

Step-by-Step Fix

1

Identify your email sending services

Make a list of every service that sends email using your domain: your email provider (Google Workspace, Microsoft 365), transactional email services (SendGrid, SES), marketing platforms (Mailchimp), and any other senders.

2

Build the SPF record

Construct an SPF record that includes all legitimate senders.

Example
v=spf1 include:_spf.google.com include:sendgrid.net -all
3

Add the TXT record in your DNS provider

Log into your DNS management console and create a new TXT record.

Example
Type: TXT
Host: @
Value: v=spf1 include:_spf.google.com include:sendgrid.net -all
TTL: 3600
4

Verify the record is published

Wait for DNS propagation and verify the record.

Example
dig +short TXT yourdomain.com | grep "v=spf1"
# Expected: "v=spf1 include:_spf.google.com include:sendgrid.net -all"

Common Gotchas

  • DNS propagation can take time. If your record does not appear immediately, wait 15-30 minutes and try again.
  • Some DNS providers require you to wrap the value in quotes; others do not. Check your provider's documentation.
  • If your domain does not send email at all, you should still publish an SPF record: v=spf1 -all (this tells receivers that no servers are authorized).

Verify Your Fix

After making changes, use our free scanner to verify the fix is working correctly. DNS changes can take up to 48 hours to propagate, but most propagate within minutes.

Frequently Asked Questions

What SPF record should I use for Google Workspace?

For Google Workspace, use: v=spf1 include:_spf.google.com -all. If you also use other email services, add their include mechanisms before the -all.

Do I need SPF if my domain doesn't send email?

Yes. If your domain does not send email, publish v=spf1 -all to explicitly declare that no server is authorized to send on its behalf. This prevents spammers from spoofing your domain.

How long does it take for an SPF record to take effect?

It depends on the TTL of your DNS records and caching by resolvers. Typically, new records propagate within minutes to a few hours. In rare cases, it can take up to 48 hours.

Related Issues