I wonder if the lack of an SPF DNS record is a factor in the decision to mark a message as spam.

I understand that an SPF fail is definitively such a factor, i.e. when SPF is configured, but a message has "MAIL FROM" / "Return-Path" domain not on the list in the SPF record.

But is the consequence of not setting SPF only letting spammers roam free? Or does it also "de-value" legitimate emails from my domain in spam algorithms, because there's no way to check?

In other words, assuming spammers don't currently spoof emails from my domain much, may adding SPF improve deliverability of legitimate messages?

  • 1
    I googled "spam score no spf" and I got a lot of answers from various spam services about this in how they score the lack of SPF record. This is not really a security question but a pure email question.
    – schroeder
    Sep 17, 2020 at 11:33
  • Don't assume spammers don't spoof your domain. They do. Sep 17, 2020 at 18:54
  • 1
    Basically any of the now common email protection systems that’s missing increases your spam score. (DKIM,DMARC,SPF)
    – LvB
    Sep 17, 2020 at 19:50

1 Answer 1


An absence of SPF isn't supposed to hurt you, but some anti-spam systems are set up to be rather aggressive and I'd worry about your luck given a system using a best-guess record (v=spf1 a/24 mx/24 ptr ?all) and then penalyzing a netural result (I don't know how common that is).

Side note: PTR in SPF is extremely ill advised (it lets any network owner forge mail as you). I also highly advise against over-permissive records like v=spf1 +all, as that's a spam indicator.

My recommendation is to at least give yourself v=spf1 a mx ?all if you self-host. Add your mail provider if you have one, e.g. v=spf1 a mx include:_spf.google.com ?all if you use gmail (you should be fine with include:gmail.com, but run it through a checker like this one). Also consider using DMARC reporting to figure out what you've missed.

If all of your mail is DKIM-signed by your domain and therefore passes DMARC, you should add an SPF record like v=spf1 ?all to make it clear that nothing passes SPF and that best-guess records should not be applied.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .