SPF is missing or in an unsafe mode

What it is

SPF (Sender Policy Framework) is a TXT record in your DNS that lists the servers authorized to send email on your behalf. When Gmail receives a message “from example.com” from a server that isn’t listed, it knows it’s a spoof.

A security problem arises in two situations:

SPF is missing entirely. Gmail has nothing to base its decision on.
SPF ends with +all or ?all. That is equivalent to “allowed from anything”, which makes SPF completely pointless.

Why it’s a problem

Without working SPF, every spoof gets through. DMARC alone isn’t enough — DMARC builds on top of SPF and DKIM.

How to fix it

I only have 1 mail server

Example for Microsoft 365:

Name:  example.cz
Type:  TXT
Value: v=spf1 include:spf.protection.outlook.com -all

For Google Workspace:

v=spf1 include:_spf.google.com -all

I have multiple senders

When you send from company mail + Mailchimp + transactional via Mailgun + e-shop via your own VPS:

v=spf1 include:_spf.google.com include:servers.mcsv.net include:mailgun.org ip4:198.51.100.5 -all

`~all` vs `-all`

-all (hardfail) — the receiving server rejects the message. Recommended.
~all (softfail) — marks it as spam but delivers it. Use this while phasing in.
?all and +all — never. They are equivalent to “no SPF”.

Watch out for the 10-lookup limit

SPF has a hardcoded limit of 10 DNS lookups. Every include: and a: counts — including the nested include: entries inside the records you pull in (a single big provider’s include: can consume several). If you exceed the limit, SPF throws a permerror and the message fails.

SPF flattening (if the limit isn’t enough)

Either consolidate your senders, or flatten the record: instead of include:, list the senders’ IP addresses directly (ip4:/ip6:), which do not count toward the limit. Beware — flattened IP addresses are then yours to maintain whenever the provider changes them.

Verification

dig TXT example.cz | grep spf

Or run a fresh scan at vulscan.app — the SPF check is part of the free scan.