Email errors

No SPF record found: what it means and how to add one

What No SPF record found means (the SPF result none), why a lookup can miss a record, and how to publish one SPF record at your domain's root.

By Updated Last verified

On this page
  1. What the message means
  2. Why the record is not found
  3. The record is on the wrong name
  4. Only the root, or only a subdomain, has one
  5. The version tag has a typo
  6. The domain sends no email
  7. Does it matter for your email?
  8. How to add an SPF record
  9. 1. List every service that sends for your domain
  10. 2. Build one record
  11. 3. Publish it on the root of your domain
  12. 4. Wait, then check
  13. A domain that sends no email
  14. Next: DMARC
  15. Sources

No SPF record found means the lookup found no TXT record starting with v=spf1 at the domain name it checked, which the SPF standard calls the result none (RFC 7208 section 4.5 (opens in a new tab)). First make sure the lookup checked the name your mail actually uses. If the record really is missing, list the services that send email for your domain, publish one TXT record on the root of your domain, often shown as @, and check again (SPF record generator). A domain that sends no email can publish v=spf1 -all (Microsoft (opens in a new tab)).

What the message means

Sender Policy Framework (SPF) (opens in a new tab) lets a domain publish, in the Domain Name System (DNS), which hosts may use its name, and receivers test the sending server against that list. The record must be a DNS TXT record (section 3.1 (opens in a new tab)). Receivers look it up at the domain in the MAIL FROM (envelope sender) address of the message (Microsoft (opens in a new tab)), or in the HELO identity (section 4.1 (opens in a new tab)).

From the TXT records at that name, a receiver keeps only those that begin with exactly v=spf1 and discards the rest (section 4.5 (opens in a new tab)). If no record is left, the result is none; if more than one is left, the result is permerror. The result is also none when the domain name does not exist in DNS (NXDOMAIN) (section 4.3 (opens in a new tab)).

A none result means the check completed without errors but reached no conclusion: the receiver has no information at all about whether the sending server is authorized (section 8.1 (opens in a new tab)). For an SPF check that returns none, Microsoft's troubleshooting table (opens in a new tab) lists the likely cause as "No SPF TXT record is published for the sending domain in DNS."

A failed lookup is something else. If the DNS server returns a failure or the query times out, the result is temperror (section 4.4 (opens in a new tab)), a transient error that a later retry may clear without any DNS change (section 2.6.6 (opens in a new tab)).

DemiSignal's check flags a missing SPF record. In its results, a fail means a record is missing or broken, and an error means the DNS lookup did not complete, so run the check again.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account

Why the record is not found

The record is on the wrong name

An SPF record sits at the exact name it covers, not in a subdomain under that name (RFC 7208 section 3 (opens in a new tab)). A record saved under another host, such as spf.example.com, is not the record for example.com. For your domain itself, Google (opens in a new tab) tells you to enter @ as the host.

Only the root, or only a subdomain, has one

If you use subdomains, each one needs its own SPF record. A record on example.com doesn't cover marketing.example.com (Microsoft (opens in a new tab)). So a lookup of a subdomain can find no record while the root domain has one. Check the exact name you entered before you add anything.

The version tag has a typo

Receivers keep only records that begin with exactly v=spf1 (RFC 7208 section 4.5 (opens in a new tab)). In the standard's own example, a record starting v=spf10 does not match and is discarded. When every record at the name is discarded, the result is none, the same as if nothing were published.

The domain sends no email

Publishing SPF records for domains that send no mail is a well-established best practice (RFC 7208 section 10.1.2 (opens in a new tab)); the last section shows the record.

Does it matter for your email?

Gmail and Yahoo both ask every sender for SPF or DKIM. DomainKeys Identified Mail (DKIM) (opens in a new tab) lets an organization claim some responsibility for a message by associating a domain name with it. Verifying the DKIM signature confirms that the signed content has not changed since it was signed (RFC 6376 section 1.5 (opens in a new tab)).

  • Gmail. Since February 1, 2024, Gmail (opens in a new tab) has required all senders to set up SPF or DKIM for their sending domains. Senders of more than 5,000 messages a day to Gmail accounts must set up SPF and DKIM, plus DMARC (opens in a new tab) (Domain-based Message Authentication, Reporting, and Conformance). Messages that aren't authenticated with these methods might be marked as spam or rejected with a 5.7.26 error. Your SPF record should include all email senders for your domain, and messages from third-party senders missing from it are more likely to be marked as spam.
  • Yahoo. Yahoo (opens in a new tab) requires all senders to implement SPF or DKIM at a minimum. Bulk senders must implement both SPF and DKIM, and publish a valid DMARC policy of at least p=none that passes. SPF records allow Yahoo to reject messages from IP addresses that the domain's SPF record does not list.

Email sender requirements sets out the Gmail, Yahoo and Outlook.com rules side by side.

Microsoft (opens in a new tab) notes that SPF alone isn't enough to prevent spoofing of a Microsoft 365 domain, and recommends DKIM and DMARC as well. A DNS finding from DemiSignal's check shows how your domain is set up; it does not show where a particular message landed.

How to add an SPF record

1. List every service that sends for your domain

Your SPF record should include all servers that send email for your domain (Google Workspace (opens in a new tab)). In simple cases that is Google Workspace alone. In others the list can include, for example:

  • on-premise mail servers, for example Microsoft Exchange
  • services that send automatic email, for example contact forms
  • any third-party provider or service that sends email for your domain

For a service you are unsure of, search its help pages for SPF or domain authentication: they name the include to add (SPF record generator). Some services send from their own domain and only need DKIM.

2. Build one record

SPF records always start with v=spf1. For a custom domain in Microsoft 365, the basic syntax is v=spf1, then the valid mail sources, then an enforcement rule (Microsoft (opens in a new tab)). Google's record for a domain that sends only through Google Workspace is:

v=spf1 include:_spf.google.com ~all

Microsoft's record for a domain where Microsoft 365 is the only source of email is:

v=spf1 include:spf.protection.outlook.com -all

If more than one service sends for you, put them all in one record: each domain can have one SPF record, and that record can list additional servers and third parties (About SPF records (opens in a new tab)). DemiSignal's SPF record generator builds the record from the services you pick, with an estimate against the 10 DNS lookup limit.

The two examples end differently: Google recommends ~all, and Microsoft recommends -all for Microsoft 365 domains. SPF record with a hard fail explains the difference.

3. Publish it on the root of your domain

Create the record at your domain registrar or DNS hosting service:

Field Value
Type TXT
Host @ for the domain itself
Value your record, for example v=spf1 include:_spf.google.com ~all

If a TXT record starting with v=spf1 already exists on the root, change that record instead of adding another. A domain can have only one SPF record (RFC 7208 section 3.2 (opens in a new tab)), and two make SPF fail with an error. Some domains require the record string in quotes; check your domain host's help pages. If you send from subdomains too, add a record for each subdomain.

4. Wait, then check

DemiSignal's SPF record generator notes that DNS changes usually show within an hour, and that some providers take up to 48 hours. Google says it can take up to 48 hours for SPF authentication to start working. Then look the domain up with DemiSignal's SPF lookup, which reads public DNS only and counts the record's DNS lookups against the limit of 10, or run the full check.

A domain that sends no email

The standard lets a domain owner publish a record declaring that no host may use the name, for names that are neither used in email addresses nor expected to send mail (RFC 7208 section 2.1 (opens in a new tab)). Doing so for a domain that sends no mail is a well-established best practice (section 10.1.2 (opens in a new tab)).

Microsoft's (opens in a new tab) example for parked domains, owned but not used for email, is this record, which says no one is authorized to send email from the domain:

v=spf1 -all

Each subdomain requires its own SPF record, so the record on the root does not speak for subdomains.

Next: DMARC

SPF alone doesn't protect your From address. SPF checks the server that sent a message, but it breaks when email is forwarded and does not cover the From address people see (SPF record generator). The next step is a DMARC record, so receivers know what to do with email that fails, and you get reports on who sends as your domain. If a check also reports a missing DMARC record, see No DMARC record found.

Sources

Tools for this

Frequently asked questions

What does No SPF record found mean?

The lookup found no TXT record starting with v=spf1 at the name it checked, which SPF calls the result none. Receivers then have no SPF information about whether the sending server is authorized.

Do I need an SPF record?

Gmail and Yahoo require every sender to use SPF or DKIM. Both require bulk senders to use SPF, DKIM and DMARC; at Gmail, bulk means more than 5,000 messages a day to Gmail accounts.

What SPF record should a domain that sends no email publish?

Microsoft's example for parked domains is v=spf1 -all, which authorizes no one to send. Each subdomain needs its own SPF record.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account