SPF record
SPF is an authorisation list for emails. It says: "Only these servers are allowed to send emails on behalf of yoursite.com". This prevents a…
Analyse my site for freeUnderstanding "SPF record"
SPF (Sender Policy Framework) is a TXT-type DNS record that explicitly lists the servers authorised to send email on behalf of your domain. When a receiving server gets an email claiming to come from yourdomain.com, it checks that domain's SPF record and verifies the sending server is indeed on the authorised list.
SPF is the oldest of the three email authentication mechanisms (alongside DKIM and DMARC) and the first line of defence against email spoofing — sending fraudulent emails that impersonate your domain.
How TheSiteFuse checks "SPF record"
TheSiteFuse queries the root domain's TXT records and looks for an entry starting with v=spf1. If found, it is displayed in full (up to 100 characters) and the check passes. If absent, a warning is returned, along with an example value to add.
Why "SPF record" matters
- Easier identity spoofing — without SPF, anyone can send an email forging the "From" field to display your domain, with no simple way for the receiving server to detect it.
- Phishing targeting your own contacts — your customers, partners or employees receive fraudulent emails that appear to legitimately come from your organisation, exploiting the trust attached to your brand.
- Degraded deliverability — even your legitimate emails can end up in spam if your domain has no SPF, as mail providers (Gmail, Outlook) increasingly penalise domains lacking basic email authentication.
Fix "SPF record" step by step
TXT record to add (adapt to your email sending provider):
# Generic example — a single sending provider v=spf1 include:_spf.google.com ~all # Example with multiple providers (website + transactional emailing) v=spf1 include:_spf.google.com include:sendgrid.net ~all
Important rules
- A domain must have only one SPF record — merge all necessary
include:entries into a single line rather than creating several distinct SPF TXT records (the second would be ignored). - The final qualifier determines strictness:
~all(soft fail — recommended to start with) marks non-compliant emails as suspicious,-all(hard fail — strictest) rejects them outright. - Technical limit: SPF allows a maximum of 10 nested DNS "lookups" (via
include:) — beyond that, verification silently fails on the recipient's side.
Verification
dig yourdomain.com TXT +short | grep spf1
Reference resource
To deepen your understanding of the technical concepts behind this check, see the dedicated Wikipedia article.
Wikipedia — SPF recordDoes your site pass this check?
Run the free full audit (120 checks) and instantly discover what needs fixing.