SPF record

mediumsecurity-spf

SPF lists which servers can send email as your domain. Without it, anyone can forge your From address. The DNS record that fixes it.

What it is

SPF (Sender Policy Framework) is a DNS TXT record on a domain's apex that lists which mail servers are authorized to send email as that domain. A receiving mail server checks the sending IP against this list before accepting a message.

Exactly one SPF record is allowed per domain — RFC 7208 treats two as a permanent error, which receiving servers handle by failing SPF entirely. A domain with duplicate records is worse off than one with none.

Why it matters

Without SPF, nothing stops anyone from sending email that claims to be from your domain — a common setup for phishing that impersonates a company to its own customers or vendors.

It's a single DNS record, published once, that lets receiving servers reject forged mail before it reaches an inbox. SPF alone isn't sufficient — pair it with DKIM and DMARC — but it's the cheapest of the three to get right.

How to fix it

with a reference doc
DNS TXT record
example.com.  IN  TXT  "v=spf1 include:_spf.google.com ~all"
DNS TXT record — merging duplicates
example.com.  IN  TXT  "v=spf1 include:_spf.google.com include:sendgrid.net ~all"

Reference documentation

Related checks

3
mediumDMARC recordDMARC is a DNS TXT record at _dmarc.<domain> that tells receiving mail servers what to do with a message that fails SPF or DKIM authentication, and where to send reports about it. Its policy value — p=none, p=quarantine or p=reject — sets how strictly that's enforced.criticalSSL certificate validityThis checks the TLS certificate a server presents on port 443: whether it has expired, whether it's about to, and whether the hostname being scanned actually appears in the certificate's subject or Subject Alternative Names.mediumStrict-Transport-Security (HSTS) headerStrict-Transport-Security (HSTS) is a response header that tells a browser to only ever connect to this host over HTTPS, for a duration set by max-age, without first trying HTTP.

This is one of the 75 checks the scanner runs. See what we check for the full list, every severity weight, and how the score is computed from them.

See whether your own site passes spf record.

One page, all 75 checks, free. No account, no card.

Run a scan