SPF records configuredWhat it checks and how to fix it

What it checks

Reads the TXT records on the domain. Passes when exactly one starts with v=spf1, warns when several SPF records are published (receivers then treat SPF as a permanent error), and fails when there is none or the domain does not exist.

Why it matters

SPF lists the servers allowed to send mail for your domain. Without it receivers cannot tell your mail from forgeries, so deliverability suffers and spoofing is easier, and Gmail and Yahoo require SPF or DKIM from every sender. Two SPF records are as bad as none, because the specification makes the check fail outright.

How to fix it

Publish a single SPF record that includes every service sending mail as your domain. If you have two records, merge them into one.

example.com.  3600  IN  TXT  "v=spf1 include:_spf.google.com include:sendgrid.net -all"

Common includes: _spf.google.com (Google Workspace), spf.protection.outlook.com (Microsoft 365), sendgrid.net, mailgun.org, amazonses.com, servers.mcsv.net (Mailchimp).

• Use ~all (soft fail) while you check that nothing legitimate is missing, then -all.
• Stay under 10 DNS lookups in total (each include, a, mx and redirect counts), or SPF fails with a permanent error.
• A domain that never sends mail should publish v=spf1 -all.

dig +short TXT example.com | grep spf1