- 157 of 200
- Security & Infrastructure
- Server, DNS & File Exposure Security
- High
Short answer: SPF is a DNS record listing the servers allowed to send email from your domain. Without it, anyone can send mail that looks like it came from you, and your own mail is more likely to land in spam. Check 157 fails if your domain has no SPF record.
What Crawl Audit checks
- Pass: a TXT record starting
v=spf1. The report shows it. - Fail: none.
It confirms the record exists. It doesn't count lookups, check for duplicate records, or judge whether it ends in ~all or -all, so check those yourself.
What the sources say
- Google, for everyone sending to Gmail since 1 February 2024: "Set up SPF or DKIM email authentication for your sending domains." Bulk senders, over 5,000 messages a day, need SPF, DKIM and DMARC.
- RFC 7208, the SPF standard: implementations "MUST limit the total number of those terms to 10". Past that, the check returns an error ("permerror") instead of a result, so SPF stops protecting any of your mail.
- RFC 7208: "A domain name MUST NOT have multiple records that would cause an authorization check to select more than one record." One domain, one SPF record.
Writing one
v=spf1 include:_spf.yourmailprovider.com ~all- Add one
include:for each service that sends as you: your mailbox provider, newsletter tool, invoicing app. Each provider gives you its exact value. - Each include can trigger further lookups. If you're near 10, remove services you no longer use.
~all(softfail) says other servers are "probably not authorized".-all(fail) is a firm no.
On devmarde.com
Our record on 6 October was v=spf1 include:zohomail.com include:spf.brevo.com ~all, covering our mailboxes and our email platform. It passes.
Sources
- IETF, RFC 7208: Sender Policy Framework (April 2014).
- Google, Email sender guidelines, checked 6 October 2026.
See how your site does on every check.
Crawl Audit runs this check and 199 others on your domain. The full report is $7.89, one time. The free check on this site covers 25.