Skip to content
Severity: Medium

Finding: No SPF Record

This finding means your domain publishes no SPF record at all. Receiving mail servers have no way to tell which servers are allowed to send email as your domain, so anyone can send mail that appears to come from your addresses.

Last updated August 11, 2026.

What it means

SPF (Sender Policy Framework) is a TXT record that lists which servers are authorized to send email for a domain. Nivaronix looked up your domain's TXT records and found none beginning with v=spf1 — no SPF record has been published at all.

Why it matters

Without an SPF record, receiving mail servers that check SPF have nothing to check against, so they cannot reject mail sent from unauthorized servers on that basis. This is how domain spoofing usually starts — attackers send mail that appears to be from you, which is the classic opening move in invoice fraud, payroll fraud, and phishing campaigns that borrow your brand's trust. This finding is separate from the one Nivaronix reports when an SPF record exists but is set to a strong policy — see SPF Record Enforces a Hard Fail for what that end state looks like.

What Nivaronix checks

Nivaronix performs a live TXT lookup on your domain and isolates any record beginning with v=spf1. This finding fires when the lookup completes but no such record is found.

Example evidence (illustrative — not live scan data)

TXT example.com: no record beginning with v=spf1

How to fix it

  1. List every service that sends email on behalf of this domain — your mail provider, helpdesk, marketing platform, invoicing tool, and anything else.
  2. At your DNS host, add a TXT record starting with v=spf1 and an include: mechanism for each of those services.
  3. End the record with ~all (soft fail) while you confirm nothing legitimate is missing from the list — publishing -all before every sender is covered will cause receivers to reject your own mail. Move to -all once the record is confirmed complete.
v=spf1 include:<your-mail-provider> ~all   # then -all once confirmed

How to verify the fix

Re-run the SPF & DMARC checker and confirm it now reports exactly one SPF record ending in an all mechanism.

Related

Check your SPF record

Scan your domain free