Missing spf

What it is

SPF (Sender Policy Framework) is a DNS record — a single line of text published at your domain's root — that tells the world's email servers which mail-sending services are officially allowed to send email on behalf of your domain. Without it, there is no published list of authorized senders, so receiving mail servers have no way to confirm whether an email claiming to be "from yourstore.com" actually came from you or from an attacker. It is one of the three foundational email-authentication standards (SPF, DKIM, and DMARC) that major inbox providers now require.

Why it matters

Without an SPF record, cybercriminals can send convincing phishing and spoofing emails that appear to come from your store's domain — targeting your customers, suppliers, and staff. Beyond fraud risk, inbox providers like Google and Microsoft use SPF as a key trust signal: missing or broken SPF causes your legitimate order confirmations, shipping updates, and marketing emails to land in spam or be rejected outright, directly harming customer experience and revenue. Google and Yahoo's 2024 bulk-sender requirements made SPF mandatory for deliverability. Failing to publish one is classified as a Security Misconfiguration (OWASP A05:2021) because it leaves your domain's identity unprotected and exploitable.

How to fix it

1. Identify every service that sends email from your domain — your ecommerce platform's transactional mail, your ESP (e.g. Klaviyo, Mailchimp), Google Workspace or Microsoft 365, and any helpdesk or CRM tools.
2. Log in to your DNS provider (the registrar or nameserver host where your domain's DNS zone is managed — e.g. GoDaddy, Namecheap, Cloudflare, Route 53).
3. Create a new DNS TXT record at the domain apex (the bare domain, e.g. yourstore.com — often represented as '@' in DNS UIs) with a TTL of 3600 (1 hour) or your provider's default.
4. Set the record value to an SPF policy that includes all your authorized senders, for example: v=spf1 include:_spf.google.com include:servers.mcsv.net ~all — replace the include: directives with the exact ones published by each of your sending services, and end with -all (hard fail) for maximum security or ~all (soft fail) while testing.
5. Verify the record has propagated using a free SPF lookup tool (search 'SPF record checker') and confirm it returns your new policy without errors such as 'too many DNS lookups' (the limit is 10).
6. Once confirmed working, consider upgrading ~all to -all and then add DKIM and a DMARC policy to complete your email-authentication setup.

; DNS TXT record to add at your domain apex (e.g. yourstore.com)
; Replace the include: values with the ones published by YOUR sending services.

@ 3600 IN TXT "v=spf1 include:_spf.google.com include:sendgrid.net include:shops.shopify.com ~all"

; Key parts:
;   v=spf1               → SPF version (required, always this value)
;   include:…            → Delegate to another provider's SPF list (add one per sending service)
;   ip4:203.0.113.5      → Authorize a specific server IP directly (use only if needed)
;   -all                 → Hard fail: reject mail from any unlisted sender (most secure)
;   ~all                 → Soft fail: accept but mark unlisted senders (use during rollout)

Fix it on your platform

Pick your platform for the exact steps.

Frequently asked questions

Authoritative references

• OWASP Top Ten — OWASP
• OWASP Cheat Sheet Series — OWASP