SPF record

The TXT record naming the servers allowed to send mail as this domain. Without one, anyone can forge your address; the ending — ~all or -all — is what makes it mean something.

• Help center

SPF (Sender Policy Framework) is a TXT record on your domain that lists the servers allowed to send mail with your domain in the envelope sender. Receiving servers compare the connecting IP address with that list; without a record they cannot tell your mail from a forgery, and spam filters treat the domain as less trustworthy.

How SiteScan grades it

The scan reads the TXT records of the registrable domain and picks those starting with v=spf1. The row shows the qualifier of the final all mechanism:

• Green — one record ending in -all (fail anything else) or ~all (soft fail), or one with no all at all.
• Warning — no SPF record, or one ending in ?all (neutral), which authorises nobody and protects nothing.
• Red — more than one SPF record (receivers then treat SPF as a permanent error, which is worse than having none), or +all / a bare all, which authorises every server on the internet.

How to fix it

Publish exactly one record that names all your senders, for example v=spf1 include:_spf.google.com include:sendgrid.net -all. Merge multiple records into one, and stay within the limit of 10 DNS lookups that include, a and mx add up to. SPF works best together with DKIM and DMARC — see email authentication.