On this page

Fixing SPF Record Issues

What it does

SPF (Sender Policy Framework) lists which mail servers are allowed to send email on behalf of your domain. Without it, anyone can send spoofed email that looks like it's from you — a common technique in phishing attacks.

This is a DNS-only fix — you can make this change yourself through your domain's DNS provider (e.g. Cloudflare, GoDaddy, Route 53, or your registrar's DNS panel), without needing help from your email or hosting provider.

How to fix it

  1. Log in to your domain's DNS provider.
  2. Add or edit a TXT record on your root domain (e.g. yourcompany.com) with a value like:
    v=spf1 include:spf.protection.outlook.com include:_spf.google.com ~all
  3. Only include the mail services you actually use to send email (e.g. Microsoft 365, Google Workspace, HubSpot, Amazon SES). Adding services you don't use weakens the record.
  4. End the record with ~all (soft fail — recommended if you're not fully confident every sender is listed) or -all (hard fail — recommended once you've verified all legitimate senders are included).
  5. Save the record and allow time for DNS to propagate (usually minutes to a few hours), then re-run a scan to confirm it passes.

Common pitfalls

  • Using +all or ?all — these effectively disable SPF protection.
  • Having more than one SPF TXT record on the same domain — only one is allowed; merge them into a single record.
  • Forgetting to update SPF when you add a new email marketing or transactional email tool.
  • Exceeding the 10 DNS lookup limit for include: statements — SPF becomes invalid if it has too many nested lookups.