SPF record missing
No SPF TXT record is published for the sending domain.
Problem summary
No SPF TXT record is published for the sending domain.
Symptoms
- DNS shows no TXT starting with v=spf1 at the sending domain
- Authentication-Results reports spf=none
- Receivers treat the domain as unauthorized for SPF
Possible causes
- SPF was never published
- Record was published on a wrong hostname (e.g. www or a subdomain)
- TXT was deleted during a DNS migration
How to diagnose
- Query authoritative TXT for the exact From/MAIL FROM domain
- Confirm whether ESP documentation expects SPF at the org domain or a subdomain
- Compare headers: spf=none vs fail/softfail
How to fix
- Publish a single SPF TXT (example): v=spf1 include:esp.example.com ~all
- Cover every authorized sender before tightening ~all to -all
- Remove duplicate or leftover non-SPF TXT that operators confuse with SPF
How to verify
- Authoritative dig/nslookup returns exactly one v=spf1 TXT
- Test send shows spf=pass from each major sending path
Prevention
- Keep a DNS change checklist that includes SPF after every ESP onboarding
- Monitor DMARC aggregate reports for sudden spf=none spikes
When to escalate
- Production mail is failing for a material share of recipients after remediation attempts