SPF record missing or invalid: how to check and fix it
SPF record high Email authentication · 14 of 100 points
What it inspects
The TXT records at the domain that start with v=spf1. This scanner expects exactly one, with valid syntax, ending in -all or ~all. If the record has no all term but a redirect=, the all term of the redirect target is judged instead. Verdicts: PASS for -all or ~all. WARN for ?all, for no all term at all (unmatched senders default to neutral), and for the record that is exactly v=spf1 ~all (it declares no senders, so it should be -all). FAIL when no SPF record exists, when more than one is published, when +all is used, when the syntax is invalid, or when SPF is published only as the deprecated SPF record type.
Why it matters
SPF tells receiving servers which hosts may send mail for your domain. Without it, or with two records (which receivers treat as a permanent error), your domain is easier to forge and your own legitimate mail is more likely to land in spam. DMARC relies on SPF or DKIM passing, so a broken SPF record weakens it too.
How to verify by hand
# bash
dig +short TXT example.com
# PowerShell
Resolve-DnsName -Name example.com -Type TXT | Select-Object -ExpandProperty Strings
Look for lines starting with v=spf1. You should see exactly one.How to fix
Publish a single TXT record at the domain name. List every service that sends your mail, then end with -all. If you send no mail at all, use the second record.
-
Remove duplicate or deprecated SPF records so only one TXT record starting v=spf1 remains.
-
Publish one record for a domain that sends mail through its own MX hosts and one provider:
example.com. IN TXT "v=spf1 mx include:_spf.provider.example -all"Replace the include with the value your mail provider documents. Start with ~all while testing if you are unsure.
-
For a domain that sends no mail:
example.com. IN TXT "v=spf1 -all"