SPF is the DNS record that lists which servers may send email for a domain. When it’s missing, duplicated or open to everyone, email from the domain is easier to fake and more likely to be rejected or land in spam.
What it means
Receiving mail servers look up the SPF record to decide whether a message claiming to come from your domain was sent by a server you allow. A domain may have only one SPF record, and it should end by flagging (~all) or refusing (-all) every other server.
What triggers it
Once a day the DNS & email security check reads the registered domain’s TXT records through public DNS and looks at those starting with v=spf1. It raises one of three versions of this issue:
- More than one SPF record (High): receiving servers then treat the domain’s SPF as broken. Owners and admins are alerted once by email and chat.
- SPF record lets anyone send email (High): the record ends in +all, which authorises every server on the internet. Owners and admins are alerted once by email and chat.
- No SPF record (Medium): only raised when the domain has MX records, so it receives email. It shows in the app and isn’t emailed.
Common causes
- A newsletter, CRM or helpdesk service was set up with its own v=spf1 record instead of being added to the existing one.
- A record ending in +all was copied from a template or added to stop delivery failures.
- Email was moved to a new provider without publishing the SPF record it asked for.
How to fix it
- List every service that sends email as the domain: your mailbox provider, newsletter tool, website, helpdesk and invoicing software. Each one’s setup guide gives the include to use.
- At your DNS provider, keep a single TXT record starting with v=spf1 that includes them all, for example v=spf1 include:_spf.google.com include:sendgrid.net ~all, and delete any others.
- End it with ~all or -all, never +all, and keep it to 10 DNS lookups or fewer (each include counts), or receiving servers treat it as failed anyway.
- Once SPF is right, add a DMARC record too. See No DMARC record.
When it clears
The issue disappears after the next daily check that no longer finds the problem, and its action drops off the action plan 7 days later.
If you mark the action done and the problem is still found 14 days later, it comes back as “Fix didn’t work”. See Using the action plan.