Cloudflare
Security & compliance
Mail domain (has MX) missing an SPF record
Part of the DNS & origin exposure check · fix arrives as a guide
What it is
The domain has MX records — so it receives mail — but publishes no SPF record.
Why it matters
SPF is what tells receivers which servers may send for the domain. Without it your own mail is more likely to be filtered, and nothing contradicts a forged sender claiming to be you.
How to fix it
Publish a TXT record listing your sending providers and ending in -all. Keep it within the ten-lookup limit — exceeding it makes the record fail, which is worse than a simpler one.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.