Where you saw it: An SPF checker, a DMARC aggregate report showing spf=none, or the Authentication-Results header of a message that landed in junk.
Why it happens
- The record was never created. A domain has no SPF by default, and nothing in DNS or in your mail platform adds one for you.
- The record was published on the wrong host. SPF belongs on the root of the sending domain, so a TXT record created at the host name spf or _spf is invisible to the check.
- The domain was moved to a different DNS provider and the TXT records were not carried over with the A and MX records.
- A subdomain is sending mail. SPF does not inherit downward, so mail.example.com needs its own record even where example.com has one.
The fix, in order
List everything that sends as your domain
Your mail platform, your marketing tool, your CRM, your helpdesk, your invoicing system and anything else that puts your domain in the envelope sender. Missing one here is the single most common cause of a broken send later.
Collect each sender's include mechanism
Every legitimate platform publishes one. Google Workspace uses _spf.google.com, Microsoft 365 uses spf.protection.outlook.com. Take the value from the vendor's own documentation rather than from a blog post.
Build one record, not several
A domain may publish exactly one SPF record. Two records is a permanent error, so combine every include into a single TXT value rather than adding a second entry.
Publish it at the domain root
Create a TXT record with the host set to @ or left blank, depending on what your DNS provider calls the root. Set the value to your assembled record.
End with a soft fail while you watch
Finish with ~all for the first week so nothing is rejected while you find the sender you forgot. Move to -all once your DMARC reports show every legitimate source passing.
v=spf1 include:_spf.google.com include:sendgrid.net ~allOne record, two senders, soft fail while you watch the reports.
How to know it worked
The short version
- Run dig +short TXT yourdomain.com and read the answer. Exactly one line should begin with v=spf1.
- Send a message to an address you control and open the full headers. Authentication-Results should read spf=pass with your sending IP.
- Check a DMARC aggregate report a day later. The spf result for each legitimate source should have moved from none to pass.
Questions people ask
Does a missing SPF record stop my mail being delivered?
Not automatically, but it removes a signal receivers rely on, and Gmail and Yahoo both require SPF or DKIM for bulk senders since February 2024. Without it you are filtered more often and you cannot pass DMARC on the SPF side.
Can I have one SPF record for several subdomains?
No. SPF is checked against the exact domain in the envelope sender, and there is no inheritance. Each sending subdomain needs its own record.
Will fixing SPF reduce my bounce rate?
It reduces filtering and rejection by policy, not bounces from addresses that do not exist. Those two problems have different causes and different fixes.