No SPF record found

Q: What does “no SPF record found” mean?

A TXT lookup on your domain returned nothing starting v=spf1. There is no policy to evaluate, so an evaluator reaches no conclusion.

Q: What SPF result does an evaluator return when no record exists?

none. RFC 7208 §8.1 says the verifier “has no information at all about the authorization”. It is distinct from fail and from pass.

Q: How do I check whether my domain has an SPF record?

dig +short TXT example.com | grep spf1, or the checker linked on this page, which also counts the lookups the record costs.

Q: What is the minimum valid SPF record for Google Workspace, Microsoft 365, SendGrid?

v=spf1 include:_spf.google.com ~all, v=spf1 include:spf.protection.outlook.com ~all, v=spf1 include:sendgrid.net ~all. Combine includes in one record if you use more than one.

Q: Where does the record go?

Host @ (the domain itself), type TXT, and exactly one such record. Not a CNAME, not a subdomain, and never two.

A check found no v=spf1 TXT record on your domain. An evaluator returns none, which is not a failure and not a pass: it means there was nothing to evaluate. Nothing is authorised and nothing is forbidden, and DMARC cannot use SPF at all. This page covers what to publish, where it goes, and what happens on domains that never send mail.

Measured 2026-09-08: 35 of 320 audited domains (10.94%) published no SPF record at all. These are domains someone had a reason to check, so this is an upper bound and not an internet-wide rate — method, window and exclusions in SPF Observatory 2026.

What was observed

A TXT lookup on your domain returned no string beginning v=spf1. Other TXT records may exist; SPF looks only for that one.

What causes it

These are protocol and measurement causes only. We do not speculate about what a receiver did with the result.

The record was never published.
It was published on the wrong host — a subdomain, or a name like spf.example.com instead of the domain itself.
It exists but the version tag is not v=spf1, so nothing matches it.
The zone was moved to a new DNS provider and this record was not carried over.

How to verify it yourself

Read every TXT record on the domain
```
dig +short TXT example.com
```
Filter to the SPF one
```
dig +short TXT example.com | grep spf1
```

Check this record Reads the live record and counts every DNS lookup it costs.

The safe fix, and what it can break

Publish one TXT record on the domain itself, host @, containing every sender you use and nothing you do not. Adding a record cannot break mail that is already being delivered on reputation alone, but publishing -all before you have listed every sender can. Inventory first, then tighten.

What can break: If you publish -all and have missed a sender, that sender's mail now fails SPF. Start at ~all, read DMARC reports until the list is complete, then move.

Examples

Valid, Google Workspace only

v=spf1 include:_spf.google.com ~all

Valid, Microsoft 365 only

v=spf1 include:spf.protection.outlook.com ~all

Valid, SendGrid only

v=spf1 include:sendgrid.net ~all

Valid, a domain that never sends mail

v=spf1 -all

Invalid — no version tag, matches nothing

include:_spf.google.com ~all

Invalid — two records, see the multiple records page

v=spf1 include:_spf.google.com ~all" "v=spf1 include:sendgrid.net ~all

What the standard says

RFC 7208 §8.1: “the SPF verifier has no information at all about the authorization”

What does “no SPF record found” mean?

A TXT lookup on your domain returned nothing starting v=spf1. There is no policy to evaluate, so an evaluator reaches no conclusion.

What SPF result does an evaluator return when no record exists?

none. RFC 7208 §8.1 says the verifier “has no information at all about the authorization”. It is distinct from fail and from pass.

Do I need SPF if I only send through Google Workspace or Microsoft 365?

Yes. The provider authenticates its own domain, not yours. Without a record on your domain there is nothing for SPF alignment to check, so DMARC cannot pass on the SPF side.

How do I check whether my domain has an SPF record?

dig +short TXT example.com | grep spf1, or the checker linked on this page, which also counts the lookups the record costs.

What is the minimum valid SPF record for Google Workspace, Microsoft 365, SendGrid?

v=spf1 include:_spf.google.com ~all, v=spf1 include:spf.protection.outlook.com ~all, v=spf1 include:sendgrid.net ~all. Combine includes in one record if you use more than one.

Where does the record go?

Host @ (the domain itself), type TXT, and exactly one such record. Not a CNAME, not a subdomain, and never two.

What about subdomains and domains that never send mail?

SPF is not inherited by subdomains. A domain or subdomain that sends no mail should publish v=spf1 -all, which states plainly that nothing is authorised.

How long before a new record is visible?

As long as the previous negative answer is cached, bounded by your zone's TTL. If no record existed before, resolvers may hold that negative answer for the SOA minimum rather than the record TTL.

Does SPF alone make DMARC pass?

Only if the domain that SPF authenticates aligns with the From domain. An SPF pass for a provider's bounce domain does not align, and DMARC then relies on DKIM.

What we do not claim

We report what your DNS publishes and what an evaluator would return from it. We do not state what any mailbox provider will do with that result: those decisions are theirs, they are not published, and we cannot measure them from here.

Reviewed by Venkat Nookala, last reviewed 2026-09-08.