Skip to content

Email deliverability

How to set up an SPF record

SPF is how a receiving server decides whether the machine that sent your mail was allowed to. Without it, Gmail and Outlook treat your mail as unauthenticated: welcome emails, password resets and receipts go to spam or are rejected outright. A permissive `+all` is worse than nothing — it passes while providing zero protection.

What 13x checks

This is rule deliverability.spf in the public registry: SPF record is present and restrictive. It runs on every audit, against the pages we actually fetched, and its result is derived from the response rather than estimated.

Surface
Email deliverability
Score weight
12 of the readiness score
Scope
Runs on every audited page
Applies
Only where the market or the page shape makes it relevant

Registry version 2026-07-30. Every rule is published, and the audit is deterministic — the same page produces the same finding every time.

The fix

The same text the audit hands you when this check fails on your own site.

Publish an SPF record as a TXT record on example.com, listing only the services that send on your behalf:

Configuration
Type:  TXT
Name:  @            (the apex, i.e. example.com itself)
Value: v=spf1 include:_spf.google.com include:amazonses.com ~all

Replace the include: values with your actual senders:

| Sender | include | | --- | --- | | Google Workspace | _spf.google.com | | Microsoft 365 | spf.protection.outlook.com | | Resend | amazonses.com | | SendGrid | sendgrid.net | | Postmark | spf.mtasv.net | | Mailgun | mailgun.org |

Three rules that matter:

- One SPF record per domain. Two records is a permanent failure, not a merge. Combine the includes into a single record. - End with `~all` or `-all`, never +all. ~all (softfail) is the safe default; -all is stricter and correct once you are certain the list is complete. - Ten lookup limit. Each include: costs one and they nest. Past ten, SPF fails entirely.

Verify with dig TXT example.com +short after the TTL expires.

Does your site have this problem?

13x checks this and 112 others against your live URL in about 30 seconds. No account, and every finding comes with the fix for your framework.

No signup. Results in 30 seconds.

More email deliverability checks