No SPF record found — what it means and how to fix it
SPF (Sender Policy Framework, RFC 7208) is a TXT record listing the servers allowed to send mail for your domain. When it is absent, a receiver has no SPF result to evaluate, so the SPF half of DMARC alignment can never pass.
A domain with no SPF is not automatically rejected, but it loses one of the two authentication signals Google, Yahoo and Microsoft expect from bulk senders — and it can be freely spoofed in envelope-sender position.
Publish exactly one SPF record on the apex of the domain, list every service that sends on your behalf, and end it with a terminal mechanism.
How to fix it
- 1List every system that sends mail as this domain: your mailbox provider, your marketing platform, your helpdesk, your billing system, your CRM, and anything on your own servers.
- 2Collect the include: value each vendor documents — for example include:_spf.google.com or include:spf.protection.outlook.com.
- 3Publish a single TXT record on the apex, for example: v=spf1 include:_spf.google.com include:sendgrid.net ~all
- 4End with ~all while you verify, then tighten to -all once you are confident nothing legitimate is missing.
- 5Re-scan and confirm the record is visible and consumes 10 or fewer DNS lookups.
Check whether your domain has this problem
Free, no signup, about two seconds. You get the exact record to paste.
Related guides
- DKIM record with empty p= — a revoked key still in use
- SPF include points at a domain with no SPF record — a silent PermError
- DMARC record syntax errors that make receivers skip your policy
- DMARC external destination not authorized — why you receive no reports
- Two DMARC records at _dmarc — why your policy is being ignored