How to Fix Your SPF Record: 5 Common Mistakes and How to Solve Them

Your SPF record might be broken. If it is, your email is at risk of landing in spam or being rejected outright. Here are the 5 most common SPF mistakes and how to fix them, step by step.

Mistake 1: No SPF Record

The most common mistake is not having an SPF record at all. If your domain has no SPF record, receiving servers have no way to verify which mail servers are allowed to send for your domain. This means anyone can send email as your domain, and receiving servers may reject your email or mark it as spam.

How to fix it: Add an SPF record to your DNS. The record should be a TXT record with the value v=spf1 include:_spf.yourmailprovider.com -all. Replace yourmailprovider.com with the actual domain of your email provider (e.g., google.com for Google Workspace, sendgrid.net for SendGrid).

Mistake 2: Multiple SPF Records

SPF only allows one TXT record per domain. If you have multiple SPF records, receiving servers will treat your domain as having no SPF record, which means your email is at risk of being rejected or marked as spam.

How to fix it: Combine all your SPF records into a single TXT record. Use the include: directive to reference other domains. For example, if you have two SPF records, v=spf1 include:_spf.google.com -all and v=spf1 include:sendgrid.net -all, combine them into v=spf1 include:_spf.google.com include:sendgrid.net -all.

Mistake 3: Too Many DNS Lookups

SPF has a limit of 10 DNS lookups. If your SPF record has more than 10 include: directives, receiving servers will treat your domain as having no SPF record, which means your email is at risk of being rejected or marked as spam.

How to fix it: Reduce the number of include: directives in your SPF record. Use the redirect directive to point to another domain that has the full list of mail servers. For example, v=spf1 redirect=_spf.yourdomain.com.

Mistake 4: Missing -all at the End

The -all directive tells receiving servers to reject any email that doesn't match your SPF record. If you don't have -all at the end of your SPF record, receiving servers may accept email from unauthorized mail servers, which means your domain is vulnerable to spoofing.

How to fix it: Add -all to the end of your SPF record. For example, v=spf1 include:_spf.google.com -all.

Mistake 5: Wrong Syntax

SPF records have a specific syntax. If your SPF record has a typo or the wrong syntax, receiving servers may treat your domain as having no SPF record, which means your email is at risk of being rejected or marked as spam.

How to fix it: Check your SPF record for typos. The record should start with v=spf1, followed by the mail servers you want to allow, and end with -all. For example, v=spf1 include:_spf.google.com -all.