Weak spf

What it is

SPF (Sender Policy Framework) is a DNS record on your domain that tells the world's email servers which computers are allowed to send email on your behalf. It works like a guest list at the door — but right now your record has no "turn away everyone not on the list" instruction at the end. That final instruction is called an "all mechanism" and it must end with either `-all` (hardfail: reject unlisted senders outright) or `~all` (softfail: accept but mark as suspicious). Without it, the record is incomplete and receiving mail servers may treat any server in the world as a valid sender for your domain.

Why it matters

An SPF record without a closing `-all` or `~all` gives spammers and phishers a green light to send email that appears to come from your store's domain. Customers receiving fake order confirmations, password resets, or "shipping delay" scams from your domain name will lose trust in your brand — and there is nothing more damaging to an ecommerce business than customers believing your email is fraudulent. Many large email providers (Gmail, Microsoft 365, Yahoo) use SPF alignment as a key spam-filtering signal, meaning your own legitimate marketing and transactional emails are more likely to land in spam if your SPF record is weak or incomplete. Under regulations like GDPR and CAN-SPAM, allowing domain spoofing can also create indirect legal exposure. Fixing this is one of the fastest, highest-impact security improvements you can make.

How to fix it

1. Log in to your DNS provider (the registrar or DNS host where your domain's DNS records are managed — e.g. GoDaddy, Cloudflare, Namecheap, Route 53).
2. Find the TXT record for your root domain (@) that starts with v=spf1. There should be exactly one SPF record per domain.
3. Read the existing record carefully. If it uses a redirect= modifier (e.g. v=spf1 redirect=something._spf.example.com), check whether the target record itself ends in -all or ~all — if it does, your record inherits that policy and may already be covered; if not, you need to add the all mechanism.
4. If the record does NOT use redirect=, append -all (recommended for strictest protection) or ~all (softer option, better for domains in transition) to the very end of the record value, separated by a space. Example: v=spf1 include:_spf.google.com include:sendgrid.net -all
5. Save the record and allow up to 48 hours for DNS propagation (usually much faster).
6. Verify the fix using a free SPF-checking tool (search 'SPF record checker') by entering your domain and confirming the record ends with -all or ~all and returns a valid result.

; Correct SPF TXT record examples:

; Strict (recommended) — unlisted senders are rejected:
v=spf1 include:_spf.google.com include:sendgrid.net -all

; Soft-fail — unlisted senders are flagged but not hard-rejected:
v=spf1 include:_spf.google.com include:sendgrid.net ~all

; If your record uses redirect=, verify the TARGET record also ends in -all:
; v=spf1 redirect=cf3962es._spf._d.mim.ec
; → look up cf3962es._spf._d.mim.ec and confirm it ends in -all or ~all

Fix it on your platform

Pick your platform for the exact steps.

Frequently asked questions

Authoritative references

• OWASP Top Ten — OWASP
• OWASP Cheat Sheet Series — OWASP