No SPF record: anyone can send email as your domain

SPF is one DNS text record listing the services allowed to send email as your domain. Without it, or with +all, anyone can. It is the first of three records (SPF, DKIM, DMARC) that stop invoice fraud in your name.

Difficulty
easy
Time
about 15 minutes
Last reviewed
2026-10-26

Is this urgent?

This week. Today if you send invoices by email.

Easy fix, no technical skills

  1. List every service that sends email as your domain: your mail provider, newsletter tool, invoicing software, CRM, website forms.

  2. Build one record. Microsoft 365: v=spf1 include:spf.protection.outlook.com -all. Google Workspace: v=spf1 include:_spf.google.com -all. Add each other service's include, for example include:sendgrid.net for SendGrid or include:spf.brevo.com for Brevo (Mailchimp campaigns need none). The free SPF record generator builds it and counts the lookups.

  3. Add it as a TXT record on the bare domain in your DNS provider (registrar, host or Cloudflare). One record only; delete any second v=spf1 record.

  4. Wait an hour and run our email security checker.

Hand it to your IT person

Copy this into an email or chat. Replace the brackets with the details from your alert.

example.com has no (or a weak) SPF record. Please publish one TXT record: v=spf1 (includes for mail provider and senders) -all, keeping under 10 lookups, then set up DKIM and DMARC.
Technical fix (commands)

  1. Current record.

    dig +short TXT example.com | grep spf1

  2. Count lookups (must be 10 or fewer).

    dig +short TXT example.com | grep spf1 | grep -o 'include:' | wc -l

Check it worked

  • Our checker shows SPF ending in -all; send yourself an email from the newsletter tool and check the headers say spf=pass.

Build your SPF record, or check SPF, DKIM and DMARC with the free tool. All free tools.

Prevent it next time

  • Add every new sending service to SPF when you sign up for it.
  • Move to DMARC p=reject once SPF and DKIM pass.

The same fix on other platforms

Common questions

Is this urgent?

This week. Today if you send invoices by email.

Can I fix this without technical skills?

Yes. The easy fix below needs no technical skills; the commands are only for your IT person.

How long does it take?

About 15 minutes once you know who runs the website.

Hear about this before your customers do

Add your website and we check uptime, certificates, domains and email security for you, free.

Add my websiteScan it first