A missing SPF record means your domain doesn't publish a list of the services allowed to send its email, so providers can't tell your real messages from fakes. Fix it by adding one TXT record at your DNS host, such as v=spf1 include:_spf.google.com ~all for Google Workspace, then re-checking your domain.
If your CyberVigil report says your domain has no SPF record, you're missing one line of text in your DNS settings. Adding it takes about 15 minutes, and you don't need to change anything inside your email account.
Check your domain below first. If the checker finds a record after all, your report may be older than your last DNS change, or the record may be on a different domain from the one you send email with.
What does "missing SPF record" mean?
SPF (Sender Policy Framework) is a public list of the services allowed to send email for your domain. It lives in your DNS as a TXT record that starts with v=spf1. When Gmail or Outlook receives a message from yourbusiness.com, it can look up that list and see whether the sending server is on it.
Our scan read the TXT records on your main domain and didn't find one starting with v=spf1. If your domain receives email, we mark this as needing attention. If it doesn't, we show a milder warning, because a domain with no mailboxes can still be impersonated.
Why does a missing SPF record matter?
Without SPF, receiving providers have no list to check, so a scammer's server and your real one look much the same. That makes it easier to send fake invoices or payment requests that appear to come from you.
It affects your own mail too. Google requires everyone who sends to personal Gmail accounts to set up SPF or DKIM, and bulk senders need SPF, DKIM and DMARC. Google also says SPF helps keep your outgoing email from being marked as spam.
SPF is one of the two building blocks of DMARC, the policy that tells providers what to do with fakes. You'll want it in place before you turn on DMARC.
What SPF record should I add?
Pick the row that matches your email provider. The name @ means your main domain, yourbusiness.com.
- TypeTXTName / Host@Valuev=spf1 include:_spf.google.com ~allGoogle Workspace
- TypeTXTName / Host@Valuev=spf1 include:spf.protection.outlook.com -allMicrosoft 365
- TypeTXTName / Host@Valuev=spf1 include:secureserver.net -allGoDaddy Professional Email or Microsoft 365 from GoDaddy
- TypeTXTName / Host@Valuev=spf1 -allDomains that never send email
Each record has three parts:
v=spf1marks the record as SPF. It must come first.include:adds a service's own list of sending servers. You need one for each service that sends as you.~allor-allcovers everyone else.~allasks providers to treat unlisted senders as suspicious, and-allsays they aren't allowed.
Google recommends ~all. Microsoft recommends -all for Microsoft 365 domains that also use DKIM and DMARC. Either one clears this finding. Avoid +all, which approves every server in the world, and ?all, which tells providers nothing useful.
Which other services send email for my business?
Your email provider is often not the only sender. Before you save the record, think about anything that sends email from an address at your domain: newsletter tools, invoicing or booking software, your website's contact form or online store, and help desk or CRM software. Google's list of senders also mentions web servers and outbound gateways.
Each service's help docs will give you its SPF include. Google publishes a few common combinations:
- TypeTXTName / Host@Valuev=spf1 include:_spf.google.com include:servers.mcsv.net ~allGoogle Workspace and Mailchimp
- TypeTXTName / Host@Valuev=spf1 include:_spf.google.com include:shops.shopify.com ~allGoogle Workspace and Shopify
Every include: costs at least one DNS lookup, and SPF allows 10 in total. Some includes pull in more lookups of their own, so Microsoft points out that fewer than 10 includes doesn't guarantee you're under the limit. Run the checker after you save. If it reports more than 10, follow our guide to fixing too many SPF lookups.
See how your whole email setup looks
Run a free scan to check SPF, DKIM, DMARC and your website in one plain-English report.
- Free check
- No signup
- No changes to your website
How do I add an SPF record at my DNS host?
Your DNS host is usually the company where you bought your domain. If your nameservers point to Cloudflare, add the record in Cloudflare even if you bought the domain elsewhere. Choose your provider below and paste the value for your email service from the table above.
Instructions for GoDaddy
- 1Sign in to your GoDaddy Domain Portfolio and select your domain.
- 2Select DNS, then Add New Record, and choose TXT as the type.
- 3Enter
@as the Name and paste your SPF value. Leave TTL at the default. - 4Select Save. GoDaddy says most changes take effect within an hour but can take up to 48 hours.
- 5This only works if your domain uses GoDaddy nameservers. If it doesn't, add the record wherever your DNS is hosted.
How do I check that SPF is working?
Google says SPF can take up to 48 hours to start working, though most hosts publish changes within an hour. Once it's live:
- Re-run the SPF checker. It should show one record and how many of the 10 lookups it uses.
- Send an email from your business account to a personal Gmail address. Open it, choose Show original, and look for
spf=pass. - Send a test from each other sender, such as a newsletter test or a sample invoice, and check those too.
If the checker still finds nothing, the Name field is the usual cause. Some hosts add your domain automatically, so typing yourbusiness.com can create a record at yourbusiness.com.yourbusiness.com. Use @, or leave the field blank on hosts that ask for that.
What should you do next?
- Add your SPF record today, then confirm it with the free SPF checker.
- Turn on DKIM in your email provider, then set up a DMARC policy so providers know what to do with fakes.
- Read SPF, DKIM and DMARC explained to see how the three fit together.
- Whenever you start using a new tool that sends email for you, add its include to this record.
Common questions
Do I need an SPF record if I use Google Workspace or Microsoft 365?
Yes. Neither service publishes SPF for your custom domain from its admin console, so you add the record at your DNS host. Microsoft's setup asks you to add one when you connect your domain, but it's easy to skip. Google notes that domains bought from a Google partner during Workspace signup may already have SPF.
Can I have two SPF records?
No. If your domain has more than one TXT record starting with v=spf1, SPF fails with a permanent error for all of your mail. When you add a new sender, edit your one record and add another include to it.
Should my SPF record end in ~all or -all?
Either works. Google recommends ~all, which asks providers to treat unlisted senders as suspicious. Microsoft recommends -all for Microsoft 365 domains that also use DKIM and DMARC. Avoid +all and ?all, which approve or ignore every sender.
Do I need SPF if my domain doesn't send email?
Yes. Publish v=spf1 -all, which says nothing should send email from the domain. Microsoft recommends this for parked domains, and pairing it with a DMARC policy of reject makes the domain much less useful to scammers.
Does SPF stop all email spoofing?
No. SPF checks the behind-the-scenes sender address that mail servers use, not the From address your customers see. DMARC connects the two, so SPF does the most good alongside DKIM and DMARC.
Sources
- RFC 7208: Sender Policy Framework (SPF) (IETF / RFC Editor)
- Set up SPF (Google Workspace Help)
- Set up SPF to identify valid email sources for your Microsoft 365 domain (Microsoft Learn)
- Add an SPF record (GoDaddy Help)
- How do I add TXT/SPF/DKIM/DMARC records for my domain? (Namecheap Knowledgebase)
- Managing DNS Records in Your Wix Account (Wix Help Center)
Related guides and tools
Keep building a safer business
Security is an ongoing process, but it doesn't have to be complicated. Run a free scan, fix what matters most, and check back for more guides.