SPF record has a syntax error
What this check looks for
Your SPF record cannot be read by receiving mail servers. Because it is unreadable, the whole check fails with an error and none of your listed senders is recognised.
Why it matters
A single typo — a missing colon, a stray space, a wrapped record — disables SPF completely, and nothing in your mail flow reports it.
When the check passes, your report says: “The SPF record parses cleanly for receiving servers”.
What it costs your score
When this check fails it removes 20 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.spf family ceiling of 35 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- high
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 20 points
- Family cap
- email-auth.spf · 35
- Category
- Email authentication
- Module
- Email spf
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Correct the record so it parses, then republish it as a single TXT record.
An unparseable record yields permerror, which authenticates nothing.
Rebuild the record in the generator, which refuses to emit anything that would fail this check.
Publish it as one TXT record; if your DNS host splits long values, make sure the strings are concatenated and not separate records.
How to confirm it worked
dig +short TXT ‹domain› — the record must parse cleanly in the SPF checker
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
Parsing the record for ‹domain› failed at ‹token›: ‹parse error›. RFC 7208 §4.6 requires a syntactically invalid record to yield permerror. Common causes are a mechanism written with a space after the colon, an unquoted or badly split TXT string, and a copied record that lost its v=spf1 prefix.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.
Other email spf checks
- SPF authorises the whole internet through an address range
- SPF record lists the same sender twice
- SPF include chain contains a loop
- SPF include target has no SPF record
- SPF is close to the 10 DNS lookup limit
- More than one SPF record published
- SPF record has no all mechanism
- No SPF record published
- SPF authorises a very large block of addresses
- SPF ends in +all — anyone may send as your domain
- SPF uses the deprecated ptr mechanism
- SPF ends in ?all (neutral)