SPF missing or too loose

Why it matters

A fraudster can send a fake invoice or a phishing mail with your domain as sender. Your clients trust it because it looks like your address. Without SPF your real mail also lands in spam more often.

How Snaglist checks it

This is part of the security check, a separate check next to the crawl, in Studio and Bureau, and only on a site you have verified. Snaglist only looks at what any visitor can see from outside. It never logs in, guesses no passwords and sends no attacks. It reads the SPF record of the domain from the DNS, through Quad9 in Switzerland, and reports it when it is missing or lets every server send.

Common causes

• The record was never added
• The record ends with +all, which lets everyone send
• A new mail service that was never added

How to fix it

1. List every service that really sends your mail: your mailbox, your newsletter, your web shop.
2. Add one SPF record to the DNS with only those services.
3. End it with ~all or -all.
4. Run the security check again to confirm.

How it shows in the report

In the report for your client this appears under the heading "Anyone can send mail on behalf of your domain". When everything is in order, the report says: "The domain says which servers may send its mail (SPF)".