webzod
account

Publish an SPF record

email.spf.missing · effort: about an hour

Why it matters

SPF is the list of servers allowed to send mail as your domain; without it anyone can send mail that claims to come from you and receivers have nothing to check it against. Publishing it also lets receivers judge your real mail more confidently.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Decide whether this domain sends mail. If it does, list every service that sends mail as your domain: your mail provider, website contact forms, newsletter tools, CRM, helpdesk, invoicing. A sender missing from the record will fail SPF.
  2. Build one record that starts with v=spf1, adds one include (or ip4/ip6) per sender, and ends in ~all. Take each include from that provider's own setup page. Examples only, use the ones that match your providers: Google Workspace uses include:_spf.google.com, Microsoft 365 uses include:spf.protection.outlook.com.
  3. Publish it as a single TXT record at the domain name itself. A domain may have only one SPF record; if one exists, edit it instead of adding another.
  4. Start with ~all (softfail) while you confirm that all real mail passes. Once DMARC reports show every legitimate sender passing, you may tighten to -all; with DMARC enforced, ~all is also acceptable.
  5. If the domain sends no mail at all (parked or web-only), publish v=spf1 -all instead. Pair it with a DMARC record of p=reject (see the DMARC fix) and, only if no mailbox uses this domain, a null MX record (MX priority 0, target a single dot) so nobody tries to deliver mail to it.
dns 
; Domain that sends mail: replace the include with the one(s) your mail provider documents
example.com.  IN TXT  "v=spf1 include:_spf.YOUR-MAIL-PROVIDER.example ~all"

; Domain that sends no mail: use this single record instead of the one above
; example.com.  IN TXT  "v=spf1 -all"
; Only if no mailbox uses this domain, also publish a null MX (RFC 7505)
; example.com.  IN MX  0 .

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.