If I leave SPF not set on my domain, is that a factor for email servers to mark emails from this domain as spam?

Question

I wonder if the lack of an SPF DNS record is a factor in the decision to mark a message as spam.

I understand that an SPF fail is definitively such a factor, i.e. when SPF is configured, but a message has "MAIL FROM" / "Return-Path" domain not on the list in the SPF record.

But is the consequence of not setting SPF only letting spammers roam free? Or does it also "de-value" legitimate emails from my domain in spam algorithms, because there's no way to check?

In other words, assuming spammers don't currently spoof emails from my domain much, may adding SPF improve deliverability of legitimate messages?

Answer 1

An absence of SPF isn't supposed to hurt you, but some anti-spam systems are set up to be rather aggressive and I'd worry about your luck given a system using a best-guess record (v=spf1 a/24 mx/24 ptr ?all) and then penalyzing a netural result (I don't know how common that is).

Side note: PTR in SPF is extremely ill advised (it lets any network owner forge mail as you). I also highly advise against over-permissive records like v=spf1 +all, as that's a spam indicator.

My recommendation is to at least give yourself v=spf1 a mx ?all if you self-host. Add your mail provider if you have one, e.g. v=spf1 a mx include:_spf.google.com ?all if you use gmail (you should be fine with include:gmail.com, but run it through a checker like this one). Also consider using DMARC reporting to figure out what you've missed.

If all of your mail is DKIM-signed by your domain and therefore passes DMARC, you should add an SPF record like v=spf1 ?all to make it clear that nothing passes SPF and that best-guess records should not be applied.