Skip to content
DomainGrade

What we checkEmailEM-01

Your domain has no SPF record

Nothing currently says which servers may send email using your domain name.

Area
Email
Check
EM-01
Included
Free in every scan

What we check

We looked up your TXT records and found none beginning with v=spf1.

Why it matters

Anyone can put your domain in the From line of an email and no receiving server can tell they are not you.

It also means DMARC has nothing to work with — the two records only protect you together.

It is also the record everything else depends on. DMARC evaluates SPF and DKIM results, so a domain with no SPF has at most one of the two signals DMARC needs, and a policy of p=reject published on top of that will fail legitimate mail as readily as forged mail.

How to fix it

  1. 1

    List every service that sends mail as you.

  2. 2

    Publish one TXT record on the domain including each of them, ending in -all.

  3. 3

    If you are not sure you have found every sender, end it in ~all first and tighten it after a fortnight of DMARC reports.

A TXT record on your domain
yourcompany.com.  IN TXT  "v=spf1 include:_spf.google.com -all"

Common questions

We do not send email from this domain.
Then publish v=spf1 -all. A domain nobody has claimed is an easy one to forge, and this claims it.
How long until it takes effect?
As soon as DNS propagates — usually minutes, at most an hour.
Will this stop mail being delivered?
Only mail from servers you did not list, which is the point. List every legitimate sender first.

See how your domain does on this check.

All 34 checks, a grade, and the exact fix for anything that isn’t right — in about twenty seconds, no signup.

Other email checks