Docs

Fix SPF

Fix SPF

SPF is one TXT record on your domain that lists the servers allowed to send mail as @example.com. Without it, anyone can put your domain in the From line, and receiving servers have no way to tell your invoices from a phishing copy. Gmail, Yahoo and Outlook.com also send mail without valid SPF or DKIM to spam more and more often, so a missing record costs you replies and orders, not just security.

The site checklist fails this item in three cases: there is no SPF record, there are two SPF records, or the record ends in +all.

What a correct record looks like

A domain has exactly one TXT record that starts with v=spf1. It names every service that sends mail for you and ends with a rule for everyone else:

Type Name Value TTL
TXT @ (example.com) v=spf1 include:_spf.google.com ~all 3600
Part Meaning
v=spf1 this is an SPF record; it must come first
include:_spf.google.com allow the servers this service lists (here Google Workspace)
ip4:192.0.2.10, a, mx allow one address, the domain's own A record, or its mail servers
~all everything else is suspicious (soft fail): the usual, safe ending
-all everything else is rejected (hard fail): use it once you are sure the list is complete
+all everything else is allowed: the same as having no SPF at all, worse because it looks set up

+a and +mx are fine: the + is just the default qualifier. Only +all is a problem.

The three failures, and what they mean:

  • No record. Add one with the services you actually send through (see below).
  • Two records. This happens when a second service asks you to "add an SPF record" and you add it next to the old one. The standard says receivers must then treat SPF as broken, so both are ignored. Merge them into one: one v=spf1, all the include: parts, one all at the end.
  • +all. Replace it with ~all.

Common include values

You send mail through Add
Google Workspace (Gmail) include:_spf.google.com
Microsoft 365 (Outlook) include:spf.protection.outlook.com
your web host (cPanel, Plesk, DirectAdmin) a mx or ip4: with the server's address, as the panel suggests
SendGrid include:sendgrid.net
Brevo include:spf.brevo.com
Mailchimp, a CRM, a ticket system, a shop platform the value from that service's DNS or domain authentication page

Do not forget the website itself: contact forms and WooCommerce order emails often leave from the web server, not from your mailbox provider.

Merging Google Workspace, a web host and SendGrid gives:

v=spf1 include:_spf.google.com include:sendgrid.net a mx ~all

Warning: SPF allows at most 10 DNS lookups. Every include, a, mx, exists and redirect counts, and so do the includes inside each include. Above 10 the whole record fails (permerror) at every receiver. Remove services you no longer use before you add new ones, and prefer ip4: for your own fixed servers.

A domain that sends no mail

A domain that only hosts a website (or a parked domain) should say so, so nobody can use it for phishing:

Type Name Value TTL
TXT @ v=spf1 -all 3600

If the domain has no MX records and no SPF, the checklist marks SPF as not applicable, but this record still protects the name.

Check it yourself

Replace example.com with your domain:

dig +short TXT example.com | grep -i 'v=spf1'

On Windows:

nslookup -type=TXT example.com

Fixed means exactly one line starting with "v=spf1, ending in ~all or -all. Two lines with v=spf1 means two records.

How to fix

SPF lives in DNS, so you change it where the domain's DNS is hosted, which is not always where the mail or the website is. If you are not sure, dig +short NS example.com shows the nameservers: *.ns.cloudflare.com means Cloudflare, a hosting company's name means your hosting panel, otherwise usually the registrar.

Google Workspace

Google Workspace does not edit your DNS. Add or change the TXT record at your DNS host (use its tab):

Type Name Value TTL
TXT @ v=spf1 include:_spf.google.com ~all 3600

If another service already has an SPF record, do not add a second one: put include:_spf.google.com into the existing record, before the all part.

In the Google Admin console, Apps → Google Workspace → Gmail → Authenticate email is for DKIM, not SPF. Set up DKIM there too: see Set up DKIM.

Microsoft 365

Microsoft 365 needs this record at your DNS host:

Type Name Value TTL
TXT @ v=spf1 include:spf.protection.outlook.com -all 3600

Microsoft suggests -all; ~all is fine while you are still checking which other services send mail for you. If the domain is managed by Microsoft (you set it up in the Microsoft 365 admin center under Settings → Domains and let Microsoft handle DNS), the record is already there; open the domain there and check DNS records.

If you also send through your web host or a newsletter tool, merge their parts into this one record.

cPanel

  1. Open Email → Email Deliverability.
  2. Find the domain. If SPF shows a problem, click Manage.
  3. cPanel shows the record it suggests, built from your server's address. If all your mail leaves through this server, click Install the Suggested Record.

The suggested record knows only this server. If you also send through Google Workspace, Microsoft 365 or a newsletter service, edit the record by hand (below) and keep their include: parts.

If the domain's DNS is hosted elsewhere (Cloudflare, the registrar), cPanel cannot change it: copy the suggested value and add it at your DNS host instead.

To edit the record by hand: Domains → Zone Editor → Manage next to the domain, filter by TXT, and edit the line that starts with v=spf1. If there are two, merge them into one and delete the other.

Plesk

Plesk creates SPF from its DNS template, typically v=spf1 +a +mx +a:server.example.net -all. That record is fine as long as all your mail leaves through the Plesk server.

To change it: Websites & Domains → example.com → Hosting & DNS → DNS (on older versions DNS Settings). Find the TXT record for example.com. that starts with v=spf1, click it, edit the value and click OK, then Update if Plesk asks you to apply the changes.

If you also send through Google Workspace or Microsoft 365, add their include: part to this record. Do not add a second TXT record with v=spf1.

If the domain uses external DNS (Cloudflare, the registrar), Plesk's DNS is not the one the world sees: edit the record there.

DirectAdmin

Account Manager → DNS Management, choose the domain. DirectAdmin usually creates a record like v=spf1 a mx ip4:203.0.113.10 ~all.

Edit that TXT record, add the include: parts of any other services that send for you, and save. If there are two v=spf1 records, merge them and delete one.

If DNS Management is missing, your host manages DNS for you: send them the record you want.

Cloudflare

  1. Open the domain and go to DNS → Records.
  2. Filter for TXT and look for values starting with v=spf1.
  3. If there is none, Add record: type TXT, name @, content e.g. v=spf1 include:_spf.google.com ~all, TTL Auto, Save.
  4. If there are two, edit one to contain all parts and delete the other.

If you use Cloudflare Email Routing, it adds include:_spf.mx.cloudflare.net. Sending through Gmail or another service at the same time is a common source of two SPF records: merge them into one.

TXT records are never proxied, so the orange cloud plays no role here.

DNS provider

At your registrar or DNS provider, open the DNS zone of the domain and add or edit one TXT record:

Type Name / Host Value TTL
TXT @ (or empty, or example.com.) v=spf1 include:_spf.google.com ~all 3600

How the name is written differs between providers: some want @, some leave the field empty, some show the full name. If you type example.com and the provider appends the domain itself, you get example.com.example.com. Check with dig afterwards.

Some providers wrap the value in quotes for you, others expect you to type them. Either way, dig should show it once, in one pair of quotes.

How long it takes

A changed TXT record is visible once the old one expires from caches, usually within the TTL (often an hour, sometimes up to a day). Mail sent in the meantime is checked against whichever version the receiver has cached.

Confirm the fix

Run the dig command from Check it yourself again, then open the target in PulseKeeper and click Check now on the Checklist tab. The item turns OK within a few minutes instead of at the next daily run.

SPF alone does not stop someone forging your From address. Add DKIM and DMARC next.