Skip to main content
All website issues
Technical Health

Your email senders are not verified (no SPF)

What this means for your business

Your domain has no SPF record — the setting that tells Gmail and Outlook which servers are allowed to send email using your domain name. Without it, the email you send (replies, invoices, newsletters) is more likely to be quietly filtered into spam, and it's easier for scammers to send mail that looks like it came from you.

How to fix it
Medium
30–60 minutes

  1. 1Find out who sends email for your domain — usually your email provider (Google Workspace, Microsoft 365) plus any marketing tools (Mailchimp, your website contact form, an invoicing app).
  2. 2Log in to wherever your domain's DNS is managed — that's usually your domain registrar (GoDaddy, Namecheap, Cloudflare) or your website host.
  3. 3Add a new DNS record of type "TXT" on the root domain (the name field is usually "@").
  4. 4Set the value to your provider's SPF string. Google Workspace: "v=spf1 include:_spf.google.com ~all". Microsoft 365: "v=spf1 include:spf.protection.outlook.com -all".
  5. 5If you send through more than one service, combine them into ONE SPF record using multiple include: parts — never create two separate SPF records (that breaks SPF).
  6. 6Save, then wait up to an hour for DNS to update and re-run the scan to confirm the record is detected.

On WordPress

WordPress itself doesn't control SPF — it's set at your domain registrar or host's DNS panel. If your host manages your email (e.g. Bluehost, SiteGround), check their knowledge base for the exact SPF value to use, or look in the email/DNS section of your hosting dashboard.

On Shopify

Shopify sends store email through its own servers. If you use a custom domain via a third-party registrar, add the SPF record there. Shopify's help docs list the exact records to add for sender authentication.

Pro tip: You can only have ONE SPF record per domain. If you already have one, add new senders as extra "include:" entries inside it rather than creating a second record — duplicate SPF records cause all of them to be ignored.

Does your site have this problem?

SiteSprout scans your site, tells you which issues you actually have in plain English, and keeps watch so nothing breaks silently.

Scan your site free