Missing spf
Quick winAdd a DNS TXT record containing a valid SPF policy to your domain so that email receivers can verify which servers are authorised to send mail on your behalf.
What it is
SPF (Sender Policy Framework) is a DNS record — a single line of text you publish at your domain — that lists every mail server and service allowed to send email from your domain address. When someone receives an email claiming to be from you, their mail server looks up this record and checks whether the sending server is on your approved list. If there is no SPF record at all, there is nothing to check against, and your domain is completely open to impersonation. Think of it as a guest list for who is allowed to send email in your name.
Why it matters
Without an SPF record, criminals can forge your domain in the "From" address of phishing or spam emails — a technique called email spoofing — and your customers, suppliers, or partners may receive fraudulent messages that appear to come from your business. This directly harms customer trust and can expose you to legal liability. Beyond fraud risk, major email providers (Google, Microsoft, Yahoo) now treat domains without SPF as suspicious and are more likely to send your legitimate transactional emails — order confirmations, shipping notices, password resets — straight to spam, costing you sales and customer satisfaction. A missing SPF record also contributes to OWASP A05:2021 Security Misconfiguration findings, which can affect security audits and partner due-diligence reviews.
How to fix it
- Identify every service that sends email from your domain — your e-commerce platform, transactional email provider (e.g. Mailgun, SendGrid, Postmark, Klaviyo), marketing platform, and any Google Workspace or Microsoft 365 account.
- Log in to the DNS management panel for your domain (usually your domain registrar: GoDaddy, Namecheap, Cloudflare, Route 53, etc.).
- Create a new DNS TXT record at the domain apex (the bare domain, e.g. example.com — sometimes shown as '@' in the Name/Host field) with a TTL of 3600 (1 hour) or your registrar's default.
- Set the record value to a single SPF string that includes all your authorised senders, for example: v=spf1 include:_spf.google.com include:sendgrid.net -all — replacing the include: entries with the exact SPF hostnames published in each email service's documentation. Use -all (hard fail) at the end; avoid +all.
- Wait for DNS propagation (up to 48 hours, usually minutes to a few hours), then verify the record using a free SPF checker tool (e.g. MXToolbox SPF Lookup) by querying your domain.
- Confirm your legitimate emails are still delivered correctly by sending test messages and checking headers for 'spf=pass'.
Fix it on your platform
Pick your platform for the exact steps.
How to fix missing spf on Shopify
- Shopify itself does not manage your domain's DNS records — DNS is controlled by wherever you registered or pointed your domain.
- If your domain was purchased through Shopify: go to Shopify Admin → Settings → Domains → click your domain → click 'Manage DNS' (or 'DNS Settings').
- Click 'Add record', choose Type = TXT, set Name/Host to '@' (the domain apex), and paste your SPF value (e.g. v=spf1 include:_spf.google.com include:sendgrid.net -all) into the Value field. Save.
- If your domain is registered elsewhere (GoDaddy, Namecheap, Cloudflare, etc.), log in to that registrar's DNS panel and add the TXT record there instead.
- Shopify's transactional emails are sent via Shopify's own infrastructure. If you use Shopify Email or Shopify's default notifications, add 'include:shops.shopify.com' to your SPF record. Confirm the exact include string in Shopify's Help Center under 'Set up email authentication'.
- Verify with MXToolbox SPF Lookup.
How to fix missing spf on WooCommerce
- WooCommerce sends email through your WordPress hosting server's PHP mail function by default — this is the most common cause of SPF failures for WooCommerce stores.
- Install a transactional email plugin such as WP Mail SMTP (free) or FluentSMTP: WordPress Admin → Plugins → Add New → search for 'WP Mail SMTP' → Install → Activate.
- Configure the plugin to route all WordPress/WooCommerce email through an authenticated SMTP service (SendGrid, Mailgun, Gmail/Google Workspace, etc.) — follow the plugin's setup wizard.
- Log in to your domain registrar's DNS panel (where your domain is registered or where DNS is hosted).
- Add a TXT record: Name = '@', Value = v=spf1 include:[your-smtp-provider-spf-hostname] -all. Your SMTP provider's documentation lists the exact include: string (e.g. 'include:sendgrid.net' for SendGrid, 'include:mailgun.org' for Mailgun).
- Verify with MXToolbox SPF Lookup and send a WooCommerce test order email to confirm delivery.
How to fix missing spf on BigCommerce
- BigCommerce transactional emails can be sent via BigCommerce's shared infrastructure or routed through a custom SMTP provider.
- To use a custom SMTP provider: BigCommerce Admin → Settings → Email → SMTP settings → enter your provider's credentials (SendGrid, Mailgun, etc.).
- Log in to your domain registrar or DNS host (the registrar where your domain is registered, or Cloudflare/Route 53 if you've delegated DNS).
- Add a new TXT record: Name/Host = '@', Value = v=spf1 include:[your-smtp-provider-include] -all. If using BigCommerce's default sending, check BigCommerce's official documentation for the current include string for their outbound mail servers.
- Save the record and wait for propagation.
- Verify using MXToolbox SPF Lookup and confirm test emails pass SPF authentication by inspecting the email headers.
How to fix missing spf on Wix
- If your domain was purchased through Wix: Wix Dashboard → Domains → click your domain → Manage → Advanced → DNS Records.
- If your domain was registered elsewhere and connected to Wix, log in to that registrar's DNS panel instead.
- In the DNS Records panel, click '+ Add Record', select Type = TXT.
- Set Host Name to '@' and Value to your SPF string, e.g.: v=spf1 include:_spf.google.com include:sendgrid.net -all
- For Wix's own email product (Wix Email Marketing), check Wix's Help Center for the correct include: hostname to add for Wix-sent mail.
- Click Save and verify with MXToolbox SPF Lookup after propagation.
How to fix missing spf on Squarespace
- If your domain is registered with Squarespace: Squarespace Dashboard → Domains → click your domain → DNS Settings → Custom Records.
- Click 'Add record', set Type = TXT, Host = '@', Data = your SPF string (e.g. v=spf1 include:_spf.google.com -all). Save.
- If your domain is registered elsewhere, log in to that registrar and add the TXT record there.
- Squarespace transactional (order) emails are sent by Squarespace's infrastructure. Squarespace automatically adds required authentication records for domains registered with them; verify by checking Squarespace's Help Center article on email authentication for the current recommended SPF include.
- If you send marketing email via Mailchimp, Klaviyo, or another tool, add those services' include: entries to the same record.
- Verify with MXToolbox SPF Lookup.
How to fix missing spf on Webflow
- If your domain is registered with Webflow: Webflow Dashboard → Webflow Workspace → Domains → click your domain → DNS Settings.
- Add a new TXT record: Name = '@', Value = your SPF string. Save.
- If the domain is registered elsewhere (GoDaddy, Namecheap, Cloudflare), log into that provider's DNS panel and add the TXT record there.
- Webflow does not send transactional store emails directly from your domain by default; these are typically handled by an integrated email provider. Check your Webflow Ecommerce settings and any connected email tools for their required SPF include: hostnames.
- Combine all required include: entries into a single SPF TXT record (you can only have one SPF record per domain).
- Verify with MXToolbox SPF Lookup.
How to fix missing spf on Adobe Commerce (Magento)
- Adobe Commerce / Magento does not manage DNS — you must update the record at your domain registrar or DNS host (Cloudflare, Route 53, GoDaddy, etc.).
- Magento's default installation sends email via the server's local sendmail/PHP mail; for reliable SPF pass, configure an SMTP extension: Admin → Stores → Configuration → Advanced → System → Mail Sending Settings → set 'Use SMTP' or install an extension such as 'Magento 2 SMTP' from the Marketplace.
- Log in to your DNS provider and add a TXT record: Name = '@', Value = v=spf1 include:[your-smtp-provider] a:your-mail-server-ip -all — replacing placeholders with your actual provider's include string.
- If using Adobe Commerce Cloud (cloud.adobe.com), consult Adobe's documentation for the SendGrid include string they provision (typically include:u[number].wl.sendgrid.net).
- Save, propagate, and verify with MXToolbox SPF Lookup.
- Send a test order confirmation and inspect the email headers to confirm 'spf=pass'.
How to fix missing spf on Shopify Plus
- Follow the same steps as Shopify above — DNS management location and Shopify-managed vs. external DNS apply identically to Plus merchants.
- Shopify Plus merchants using custom transactional email routing (e.g. via SendGrid or Postmark configured in the Plus admin) must also add the include: directive for that provider.
- For enterprise setups with a dedicated IP, confirm the exact SPF include string with your email delivery provider and add it to the record.
How to fix missing spf on Magento Open Source
- DNS is managed at your registrar or hosting provider — not inside Magento.
- Log in to your DNS provider and add a TXT record at '@' with your full SPF value.
- In Magento admin, go to Stores → Configuration → Advanced → System → Mail Sending Settings to confirm the SMTP host in use, then add that provider's SPF include: directive to your record.
- Common setups include a server-local sendmail (add your server's IP as 'ip4:x.x.x.x') or a third-party SMTP relay like SendGrid or Mailgun (use their published include: tag).
- Verify propagation with a free SPF lookup tool.
How to fix missing spf on PrestaShop
- DNS is managed at your registrar or hosting control panel, not inside PrestaShop.
- Add a TXT record at '@' with your SPF value at your DNS provider.
- In PrestaShop back office, go to Advanced Parameters → Email to see the outbound mail method (PHP mail vs. SMTP) and the SMTP server configured. Add that provider's SPF include: directive.
- Verify propagation with a free SPF lookup tool.
How to fix missing spf on BigCommerce for WP
- BigCommerce for WP is a headless/channel setup; email sending follows BigCommerce's infrastructure. Add 'include:_spf.bigcommerce.com' (verify current tag in BigCommerce docs) to your domain's TXT record at your DNS provider.
- WordPress-side emails (admin notifications, password resets) are sent via your host's PHP mail or an SMTP plugin — add that provider's include: tag as well.
- Add the TXT record at '@' in your registrar or DNS host dashboard and verify propagation.
How to fix missing spf on WooCommerce REST API
- This is a headless WooCommerce setup; email is still sent by the WordPress/WooCommerce backend via your SMTP configuration.
- Identify your SMTP provider in your SMTP plugin settings (e.g. WP Mail SMTP → Settings) and add its SPF include: tag to a TXT record at '@' in your DNS provider.
- Verify propagation.
Does your site have this issue?
Run a free SEOLZ scan to find missing spf — and every other issue — across your whole site in minutes.
Scan my site freeFrequently asked questions
What is Missing spf?
SPF (Sender Policy Framework) is a DNS record — a single line of text you publish at your domain — that lists every mail server and service allowed to send email from your domain address. When someone receives an email claiming to be from you, their mail server looks up this record and checks whether the sending server is on your approved list. If there is no SPF record at all, there is nothing to check against, and your domain is completely open to impersonation. Think of it as a guest list for who is allowed to send email in your name.
Why does missing spf matter?
Without an SPF record, criminals can forge your domain in the "From" address of phishing or spam emails — a technique called email spoofing — and your customers, suppliers, or partners may receive fraudulent messages that appear to come from your business. This directly harms customer trust and can expose you to legal liability. Beyond fraud risk, major email providers (Google, Microsoft, Yahoo) now treat domains without SPF as suspicious and are more likely to send your legitimate transactional emails — order confirmations, shipping notices, password resets — straight to spam, costing you sales and customer satisfaction. A missing SPF record also contributes to OWASP A05:2021 Security Misconfiguration findings, which can affect security audits and partner due-diligence reviews.
How do I fix missing spf?
Add a DNS TXT record containing a valid SPF policy to your domain so that email receivers can verify which servers are authorised to send mail on your behalf.
Authoritative references
- OWASP Top Ten — OWASP
- OWASP Cheat Sheet Series — OWASP