Skip to content
DomainGrade

What we checkEmailEM-01

SPF record

SPF is a DNS record listing which servers may send email using your domain name.

Area
Email
Check
EM-01
Included
Free in every scan

What we check

We look up the TXT records on your domain and check for one beginning with v=spf1.

Exactly one is expected. Two SPF records is not twice the protection — receivers treat it as a permanent error and fall back to trusting nothing.

Why it matters

Without SPF, anybody who can send email can put your domain in the From line, and the receiving server has no way to tell the difference between them and you.

That is how invoice fraud works: a message that appears to come from your finance team, to a customer who has no reason to doubt it.

SPF is also a prerequisite for DMARC, which is the record that actually tells receivers what to do about a forgery.

How to fix it

  1. 1

    List every service that sends mail as you — your mail provider, your newsletter tool, your invoicing system, your helpdesk.

  2. 2

    Publish one TXT record on the domain itself (not a subdomain) that includes each of them.

  3. 3

    End it with -all, which means 'nothing else is authorised'. Start with ~all if you are unsure you have found every sender, then tighten it once DMARC reports confirm you have.

A TXT record on your domain
yourcompany.com.  IN TXT  "v=spf1 include:_spf.google.com include:sendgrid.net -all"

Common questions

I have two SPF records. Is that a problem?
Yes, and a bigger one than having none: receivers treat multiple SPF records as a permanent error and ignore both. Merge them into a single record with all the includes from each.
What is the ten-lookup limit?
Each include: costs a DNS lookup, and SPF allows ten before receivers give up and treat the check as failed. If you are near the limit, flatten the includes you control or drop services that no longer send for you.
Do I need SPF on a domain that never sends email?
Yes. A domain with no mail is a domain nobody has claimed, which makes it an attractive one to forge. Publish v=spf1 -all and a DMARC record with p=reject.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other email checks