SPF include target has no SPF record
What this check looks for
Your SPF record refers to another domain that does not publish an SPF record of its own. That reference produces an error, and the error breaks the whole check.
Why it matters
This usually means a service was decommissioned or a domain was misspelled. Either way it turns a working SPF record into a broken one.
When the check passes, your report says: “Every include target publishes an SPF record of its own”.
What it costs your score
When this check fails it removes 15 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.spf family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- high
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 15 points
- Family cap
- email-auth.spf · 35
- Category
- Email authentication
- Module
- Email spf
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Remove the broken include, or correct it to the domain the provider documents.
An include that resolves to no record makes the entire evaluation return permerror.
Check the spelling of
‹include domain›against your provider's documentation.If the service is no longer used, delete the include — this also frees a DNS lookup.
How to confirm it worked
dig +short TXT ‹include domain› — expect a v=spf1 record, or remove the include
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
include:‹include domain› resolved to no SPF record. RFC 7208 §5.2 states that when an include evaluates to none, the result is permerror — the include is not simply skipped. The same applies to a redirect= target with no record.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other email spf checks
- SPF authorises the whole internet through an address range
- SPF record lists the same sender twice
- SPF include chain contains a loop
- SPF is close to the 10 DNS lookup limit
- More than one SPF record published
- SPF record has no all mechanism
- No SPF record published
- SPF authorises a very large block of addresses
- SPF ends in +all — anyone may send as your domain
- SPF uses the deprecated ptr mechanism
- SPF ends in ?all (neutral)
- SPF has both redirect= and an all mechanism