SPF record is missing or too permissive

SeverityMedium

ScopeWhole site

EffortSmall

Verified bySecurity scan (weekly, or Re-scan)

Rule keysec_spf

Short answer

Publish exactly one TXT record on your domain that starts with v=spf1, lists every service that sends your e-mail and ends in ~all or -all, for example v=spf1 include:_spf.google.com ~all. A domain that sends no e-mail can publish v=spf1 -all.

Why it matters

SPF tells receiving mail servers which servers may send mail for your domain. Without it, or with +all (which authorises every server on the internet), a forged message using your domain looks no less legitimate than a real one. Gmail and Yahoo require SPF or DKIM on all mail and both, plus DMARC, from bulk senders, so a missing or broken record also hurts the delivery of your own newsletters and invoices.

SPF alone does not protect the From: address readers see; that takes DMARC on top. There is no search ranking effect, but phishing sent in your name damages trust in your brand.

How Glimana detects it

Glimana reads the TXT records of your registrable domain (for example example.com, even if the site runs on www or a subdomain) through public DNS-over-HTTPS resolvers and keeps those starting with v=spf1. No SPF record is medium if the domain has MX records and low if it receives no mail; more than one SPF record is medium (the standard makes that an error); a record ending in +all or a bare all is high; ?all, or no all at all (receivers treat that as neutral), is low. ~all and -all pass, as does a record that hands over with redirect=. The 10-lookup limit is not counted. If DNS could not be queried, the result is Could not be measured.

How to fix it

Watch out

SPF allows at most 10 DNS lookups (include, a, mx, exists, redirect); a record that needs more fails at receivers even though it looks fine, and Glimana does not count them. If you have two v=spf1 records, merge them into one instead of adding a third. Move to -all only after every sender is listed: newsletter tool, CRM, helpdesk and the website's own contact-form mail.

Find the finding in Glimana. Open Security; this check is in the E-mail and DNS group, with the evidence from the last scan under its title. The same problem is listed under Issues › SPF record is missing or too permissive.
Apply the fix on your platform.

CloudflareOther DNS providersDomain that sends no e-mail

Go to DNS › Records. Edit the existing TXT record that starts with v=spf1, or click Add record: Type TXT, Name @, Content v=spf1 include:_spf.google.com ~all (replace the include with your provider's value). Keep only one such record.

Add a TXT record with host @ (or empty, depending on the panel). Combine all senders in one value, e.g. v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all. Your mail provider and each sending service document their own include: value. Check the result with dig +short TXT example.com.

Publish v=spf1 -all on the domain. Together with a DMARC record of v=DMARC1; p=reject; this tells receivers to reject anything claiming to come from it.
Check it in Glimana. Press Re-scan on the Security page (up to two scans an hour) or wait for the weekly scan on Sunday; the problem closes when the check passes.

How the fix is verified

After changing DNS, wait until the old record's TTL has passed, then press Re-scan on the Security page (or wait for the weekly Sunday 04:00 scan); the problem closes when the check passes.