Gulf CybersecurityBaseline
العربيةCheck your domain
Kuwait City at night from space, its streets in amber light along the dark water of the bayRiyadh at night from space, a wide grid of white and amber light in the desertDubai at night from space, with Palm Jumeirah lit in the sea below the coast roadDoha at night from space, the city's lights spreading from the bay along its roadsBahrain at night from space, the island's towns joined by lit roads in a dark seaMuscat and Al Seeb at night from space, the coast road and the airport in amber light beside a dark sea

SPF in place

Authorised senders (SPF)

Does the domain list the servers allowed to send its mail?

Why it matters

SPF lets a receiver check whether the server handing over a message is one the domain authorises. A record without a closing fail rule, a second record, or a chain that needs more than 10 DNS lookups is treated as no record at all by many receivers, and DMARC cannot rely on it.

When a domain passes

Passes with exactly one SPF record that ends in a strict or soft fail rule and stays within 10 DNS lookups.

How to fix it

  1. List every service that sends mail as the domain, such as the mail platform, newsletters and ticketing systems.
  2. Publish one SPF record that includes them all and ends with the strict fail rule, or the soft one while you are still checking.
  3. Merge duplicate records and flatten includes that push the chain past 10 lookups.

An example record

example.com  TXT  "v=spf1 include:spf.protection.outlook.com -all"

Reference specifications

All thirteen standards