No SPF record on your domain

What it means

SPF (Sender Policy Framework) is a short line of text published in your domain's DNS. DNS is the public address book of the internet. The SPF line lists the servers that are allowed to send email using your domain name.

When it is missing, a receiving server like Gmail or Outlook has no way to check if the server that sent your email is really yours.

Why it matters

• Gmail, Yahoo and Outlook now expect every sender to have SPF (or DKIM), and bulk senders to have both.
• Without it, your emails are more likely to land in spam or be rejected.
• Anyone can pretend to send email from your domain more easily.

How to check

Delivmail checks this for you in two ways:

• Send a test email: on the home page, copy your unique test address, send it a normal email from the mailbox you want to check, then open the report. The SPF line shows "none" when no record exists.
• Use the Domain scanner: type your domain at /domain-scanner to read your DNS records without sending anything.

How to fix it

1. List every service that sends email for you. Your mailbox provider (Google Workspace, Microsoft 365, your web host), and also your newsletter tool, online shop, CRM or website contact form.
2. Find each service's SPF value. Each provider gives an include: value in its help pages. Common ones:
   • Google Workspace: include:_spf.google.com
   • Microsoft 365: include:spf.protection.outlook.com
   • Your own server: ip4: followed by its IP address
3. Log in to your DNS provider. This is usually where you bought your domain (GoDaddy, OVH, Namecheap, Cloudflare, IONOS…).
4. Add a TXT record on the domain itself. The host or name field is often @ or left empty.
5. Paste one single line that combines all your senders.

Google Workspace only:

v=spf1 include:_spf.google.com ~all

Microsoft 365 only:

v=spf1 include:spf.protection.outlook.com -all

Google Workspace plus a newsletter tool plus your own server:

v=spf1 include:_spf.google.com include:spf.newsletter-example.com ip4:203.0.113.10 ~all

What the ending means

• ~all (soft fail): servers not listed are suspicious. A safe choice while you are setting things up.
• -all (hard fail): servers not listed are not allowed. Use it once you are sure your list is complete.
• Never use +all: it allows the whole internet to send as you.

Domains that never send email

If a domain is not used for email at all, protect it with:

v=spf1 -all

Check that it is fixed

DNS changes are not instant. Most are visible within a few minutes, but some providers take up to 24 to 48 hours.

Then run the Domain scanner again: the SPF line should be valid. Finally send a new test email from the home page. The report should show SPF as passing for your domain.

More help from providers: Google Workspace SPF guide and Microsoft 365 SPF guide.