Fix the syntax error in the SPF record

Why it matters

Receivers return a permanent error for an SPF record they cannot parse, so SPF fails for every sender until it is fixed. The scan names the part that did not parse.

The fix

1. Read the error named in the finding. Common causes: an unknown mechanism name, a missing colon (include:example.com, not include example.com), a bad IP address or prefix length, a stray quote or curly quote pasted from a document, or a modifier written like a mechanism.
2. The record must start with exactly v=spf1, terms are separated by single spaces, and qualifiers are +, -, ~ or ? placed directly before the mechanism (-all, ~all).
3. Correct the record in place (one TXT record, not an extra one), then re-scan. Mechanisms valid in SPF are all, include, a, mx, ptr, ip4, ip6 and exists; modifiers are redirect and exp.

example.com.  IN TXT  "v=spf1 include:_spf.YOUR-MAIL-PROVIDER.example ip4:203.0.113.25 ~all"

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the SPF record check
• Publish an SPF record
• Merge the SPF records into one
• Replace +all in the SPF record with ~all
• Narrow the very large address range in the SPF record
• Change ?all in the SPF record to ~all
• Choose the right SPF ending for this domain
• End the SPF record with ~all or -all
• Bring the SPF record under 10 DNS lookups
• Leave room under the SPF lookup limit
• Remove SPF terms that point at names that no longer exist
• Fix the SPF include that has no SPF record
• Break the loop in the SPF includes
• Replace the include that has several SPF records
• Replace the ptr mechanism in the SPF record
• Check the SPF terms that use macros
• Re-run the scan if part of the SPF record could not be read