auth.spf.missing
SPF Record Missing
What we check
We query DNS for a TXT record beginning with v=spf1 at the domain apex. SPF (Sender Policy Framework) lets a receiving mail server verify that a message came from an IP address the domain owner authorized to send on its behalf.
What this finding means
No SPF record was found at the domain apex. Receivers have no published list of authorized sending IPs, so they cannot use SPF to distinguish your legitimate mail from a forgery.
Why it matters
- Spoofing exposure. Without SPF, any server can send mail claiming your envelope domain and receivers have no IP-based signal to reject it.
- DMARC needs it. DMARC passes on SPF or DKIM alignment. With no SPF record, you lose one of the two alignment paths — mail that isn't DKIM-signed and aligned cannot pass DMARC at all.
- Deliverability. Major mailbox providers weigh SPF heavily. A domain with no SPF record sees more of its mail sorted to spam.
How to fix
Publish an SPF TXT record at the apex listing your authorized senders and ending in
-all(hardfail) or~all(softfail during rollout):example.com. IN TXT "v=spf1 include:your-provider.example -all"Replace
include:your-provider.examplewith your mail provider's published SPF include (Microsoft 365, Google Workspace, your host, etc.), and addip4:/ip6:mechanisms for servers you run directly.Keep it to one record. A domain must publish exactly one
v=spf1record — multiple records are a permanent error at every receiver.Stay under 10 DNS lookups. Each
include,a,mx,ptr, andexiststerm costs a lookup; exceeding 10 fails SPF outright.
How it's graded
A missing SPF record carries a 30-point deduction in the Authentication category. See Grading Methodology for the full scoring model.
Evidence example
$ dig +short TXT example.com
"v=DKIM1; ..." (other TXT records present, but no v=spf1 record)