Weak spf

Quick win

Add a hard-fail (-all) or soft-fail (~all) terminator to your SPF DNS record so that mail servers reject or flag email sent from servers not explicitly authorized by your domain.

What it is

SPF (Sender Policy Framework) is a DNS record that tells the world which mail servers are allowed to send email on behalf of your domain. The record ends with a mechanism that instructs receiving mail servers what to do with messages from servers that are not on your approved list. A record that ends without `-all` (hardfail) or `~all` (softfail) — or that redirects to another SPF record that itself has no proper terminator — is considered "weak" because it gives receiving servers no clear instruction to reject or flag unauthorized senders. This is the exact situation in a record like `v=spf1 redirect=cf3962es._spf._d.mim.ec` where the final verdict depends entirely on the target record and may resolve to a neutral or missing terminator.

Why it matters

Without a proper SPF terminator, spammers and phishers can send emails that appear to come from your domain and pass (or get no verdict on) SPF checks — making it trivially easy to impersonate your brand in phishing campaigns targeting your customers and suppliers. This directly damages customer trust, can get your legitimate email domain blacklisted, and reduces inbox delivery rates for your real marketing and transactional emails, hurting revenue. From a compliance perspective, email spoofing facilitated by a weak SPF record can expose you to regulatory scrutiny under data-protection and anti-fraud laws. OWASP A05:2021 (Security Misconfiguration) explicitly covers this class of configuration omission.

How to fix it

Look up your current SPF TXT record by querying your domain's DNS: run `dig TXT yourdomain.com` in a terminal or use an online DNS lookup tool (e.g., MXToolbox SPF checker).
Identify the full chain: if your record uses `redirect=` or `include:`, trace each referenced record until you reach the end of the chain and confirm what terminator (if any) is present.
Decide on a terminator: use `-all` (hardfail — receiving servers SHOULD reject unlisted senders; strictest, recommended) or `~all` (softfail — receiving servers should accept but mark/quarantine; useful as a stepping-stone while auditing senders). Avoid `+all` (allows everyone — worse than no record) and `?all` (neutral — no enforcement).
Edit the SPF TXT record at your DNS provider (registrar or hosting DNS zone editor) to ensure the record itself — or the final record in any redirect chain — ends with `-all` or `~all`.
Save the record and wait for DNS propagation (typically 5–30 minutes for most providers, up to 48 hours globally).
Verify the fix using an SPF validation tool (MXToolbox, Google Admin Toolbox, or `dig TXT yourdomain.com`) and confirm the terminator is present and the full chain resolves correctly.

Fix it on your platform

Pick your platform for the exact steps.

How to fix weak spf on Shopify

Shopify does not host your domain's DNS — it only registers the domain via Shopify Domains or points to an external registrar.
If your domain is managed through Shopify Domains: go to Shopify Admin → Settings → Domains → click your domain → 'DNS Settings'. Find the TXT record starting with `v=spf1` and click Edit.
Append `-all` (or `~all`) to the end of the record value if it is missing, e.g. change `v=spf1 redirect=cf3962es._spf._d.mim.ec` to `v=spf1 redirect=cf3962es._spf._d.mim.ec -all` (only if the redirect target itself doesn't end with `-all`; otherwise fix the target record instead).
If your DNS is managed externally (GoDaddy, Cloudflare, Namecheap, etc.), log in to that provider's DNS dashboard and edit the TXT record there — Shopify's admin cannot manage it.

Full Shopify guide →Official Shopify docs ↗

How to fix weak spf on WooCommerce

WooCommerce is a WordPress plugin; your DNS is managed by your domain registrar or hosting provider (e.g., cPanel, Cloudflare, GoDaddy).
Log in to your hosting control panel (cPanel → Zone Editor, or Plesk → DNS Settings) or your domain registrar's DNS management page.
Find the TXT record for your root domain (`@`) starting with `v=spf1`. Click Edit.
Ensure the record ends with `-all` or `~all`. Save and allow DNS to propagate.
If you use Cloudflare for DNS: log in to Cloudflare → your domain → DNS tab → find the SPF TXT record → Edit → add `-all` at the end of the value.

Full WooCommerce guide →Official WooCommerce docs ↗

How to fix weak spf on BigCommerce

BigCommerce does not manage your DNS. DNS is controlled by your domain registrar or a CDN/DNS provider such as Cloudflare.
Log in to your domain registrar (e.g., GoDaddy, Namecheap, Google Domains/Squarespace Domains) or DNS provider.
Navigate to DNS Management / Zone Editor for your domain.
Locate the TXT record starting with `v=spf1`. Edit it to add `-all` (recommended) or `~all` at the very end of the record value.
Save the record and verify propagation with an SPF checker tool.

Full BigCommerce guide →Official BigCommerce docs ↗

How to fix weak spf on Wix

In Wix, go to your Dashboard → Domains → click the relevant domain → Manage DNS Records.
Scroll to the TXT Records section and find the record beginning with `v=spf1`.
Click Edit (pencil icon) next to that record.
In the Value field, append `-all` or `~all` to the end of the existing value so it reads, e.g., `v=spf1 include:example.com -all`.
Click Save and wait for DNS propagation (Wix typically shows a warning that changes can take up to 48 hours).
If the domain's DNS is pointed to an external provider, you must make this change at that provider instead.

Full Wix guide →Official Wix docs ↗

How to fix weak spf on Squarespace

In Squarespace, go to the Home Menu → Settings → Domains → click your domain → DNS Settings.
Under 'Custom Records', find the TXT record starting with `v=spf1`.
Click Edit and update the record value to include `-all` or `~all` at the end.
Click Save.
If your domain's nameservers are pointed away from Squarespace (e.g., to Cloudflare), you must edit the record at whichever provider is authoritative for your DNS.

Full Squarespace guide →Official Squarespace docs ↗

How to fix weak spf on Webflow

Webflow does not provide a full DNS editor for custom records on all plans. DNS for Webflow sites is typically managed externally at your registrar or a DNS provider.
Log in to your DNS provider (Cloudflare, GoDaddy, Namecheap, etc.) where your domain's nameservers point.
Find the DNS / Zone management section and locate the TXT record for `@` (root domain) starting with `v=spf1`.
Edit the record value to end with `-all` or `~all`. Save the change.
Verify with an SPF validation tool after propagation.

Full Webflow guide →Official Webflow docs ↗

How to fix weak spf on Adobe Commerce (Magento)

Adobe Commerce (Magento) is self-hosted or cloud-hosted; DNS is managed at your registrar or hosting provider, not within Magento itself.
Log in to your DNS provider's control panel (cPanel Zone Editor, Plesk DNS, Cloudflare, Route 53, etc.).
Locate the TXT record for your root domain beginning with `v=spf1`.
Edit the record to append `-all` (hardfail) or `~all` (softfail) at the end of the record value.
Save the record and confirm propagation with `dig TXT yourdomain.com` or an online SPF checker.

Full Adobe Commerce (Magento) guide →Official Adobe Commerce (Magento) docs ↗

How to fix weak spf on WordPress.org

SPF is set at your DNS/registrar, not in WordPress itself.
Log in to your hosting control panel (cPanel → 'Zone Editor' or 'Email Deliverability') or your external DNS provider.
Find the TXT record for @ starting with v=spf1.
If you use an SMTP plugin (WP Mail SMTP, Fluent SMTP, Easy WP SMTP) connected to SendGrid, Mailgun, Brevo, etc., include that provider's SPF include value before adding -all.
Save and test with an SPF checker.

Full WordPress.org guide →Official WordPress.org docs ↗

How to fix weak spf on PrestaShop

PrestaShop does not manage DNS. Log in to your domain registrar or hosting DNS panel.
Find the TXT record for your root domain (@) starting with v=spf1.
If you send email via your server's native PHP mail or a configured SMTP (set in PrestaShop Back Office → Advanced Parameters → Email), ensure the sending server IP or SMTP relay's include: entry is present.
Append -all to the end of the record and save.

Full PrestaShop guide →Official PrestaShop docs ↗

How to fix weak spf on OpenCart

OpenCart does not manage DNS. Edit SPF at your registrar or hosting DNS panel (e.g. cPanel Zone Editor).
Identify what mail service OpenCart is configured to use: Admin → System → Settings → Mail tab. Include that service's SPF include value in your record.
Append -all at the end and save.

Full OpenCart guide →Official OpenCart docs ↗

Does your site have this issue?

Run a free SEOLZ scan to find weak spf — and every other issue — across your whole site in minutes.

Scan my site free

Frequently asked questions

What is Weak spf?

SPF (Sender Policy Framework) is a DNS record that tells the world which mail servers are allowed to send email on behalf of your domain. The record ends with a mechanism that instructs receiving mail servers what to do with messages from servers that are *not* on your approved list. A record that ends without `-all` (hardfail) or `~all` (softfail) — or that redirects to another SPF record that itself has no proper terminator — is considered "weak" because it gives receiving servers no clear instruction to reject or flag unauthorized senders. This is the exact situation in a record like `v=spf1 redirect=cf3962es._spf._d.mim.ec` where the final verdict depends entirely on the target record and may resolve to a neutral or missing terminator.

Why does weak spf matter?

How do I fix weak spf?