Fixing a missing or broken SPF record

MailMedic flags SPF as failing in three situations: there is no record at all, there are two records, or the record does not include the services you actually send from. The fix is the same shape in all three cases.

1. Find where your DNS is managed

This is usually the company you bought the domain from, but not always — if you use Cloudflare, DNS lives there instead. MailMedic shows your current nameservers on the scan result page, which tells you where to log in.

2. Look at what you already have

Search your DNS records for a TXT record starting with v=spf1. If you find one, you are editing it, not adding a second one.

3. Build the correct record

List every service that sends mail using your domain. For a typical Shopify store that means Shopify itself, plus your business mailbox provider, plus any marketing tool.

v=spf1 include:shops.shopify.com include:_spf.google.com ~all

• include: — adds another service's permitted servers to your list
• ~all — anything not listed is a soft failure (recommended)
• -all — anything not listed is a hard failure (only once you are certain the list is complete)

4. Save and wait

DNS changes are not instant. Most providers publish within minutes, but some take a few hours. Re-run the MailMedic scan after an hour; if it still fails, check for a typo or a duplicate record before changing anything else.

Related articles

• SPF, DKIM and DMARC explained without jargon
• Setting up DKIM for your domain
• Moving DMARC from p=none to enforcement safely
• Why your Shopify order emails land in spam