Email security

How to fix: SPF record

SPF (Sender Policy Framework) is a DNS TXT record listing which servers are allowed to send email for your domain.

Not sure whether your site has this problem? Check it in seconds.

Why it matters

Receiving mail servers use SPF to spot messages that claim to come from your domain but were sent from somewhere else. Without it, spoofed email is more likely to be delivered, and your legitimate mail is more likely to land in spam.

How to check

Look up the TXT records of your root domain and find the one that starts with v=spf1. Our Email Security checker does this for you.

How to fix it

Google Workspace

Type: TXT   Name: @   Value: v=spf1 include:_spf.google.com ~all

Microsoft 365

Type: TXT   Name: @   Value: v=spf1 include:spf.protection.outlook.com ~all

Domain that sends no email

Type: TXT   Name: @   Value: v=spf1 -all

Common mistakes

Publishing more than one SPF record. A domain must have exactly one; multiple records make SPF fail. Merge them into a single record.
Exceeding 10 DNS lookups (each include, a, mx, redirect counts). Receivers treat that as a permanent error.
Forgetting a sender (your newsletter or invoicing tool) so its mail starts failing. List every service that sends as you.
~all (soft fail) is a sensible start; -all (hard fail) is stricter. Move to -all only once you're sure the list is complete.

Frequently asked questions

Is SPF enough on its own?

No. SPF checks the hidden envelope sender, not the From address people see. Pair it with DKIM and DMARC.

Related guides

Guidance is general. Test header and DNS changes on a staging copy first, and check your hosting provider's documentation for platform-specific steps.