SPF

How it works

• It is a single line of text in your domain's DNS.
• The receiving server checks whether the sending server is on the list.
• Every service that sends as you (email, newsletters, invoicing) goes on it.
• Too many entries or two records break it.

What can go wrong (example scenario)

A six-person law firm had no SPF record. A scammer sent emails “from” the managing partner asking a client to wire a retainer to a new account. The client's inbox had no way to doubt it.

How WILDCARD handles it

Domain Security keeps the SPF record accurate: one record, every legitimate sender listed, and a hard fail at the end once every service that sends for you is confirmed. Email Security checks the same signals on mail coming in.

• A dental office adds an appointment-reminder service and needs it added to SPF so reminders reach patients.
• A retailer uses Shopify for order emails and Microsoft 365 for staff; both belong on the one SPF record.
• A non-profit's volunteers send from a donation platform. If that platform is missing from SPF, thank-you emails get junked.

Example scenario: A small HVAC contractor started using a new scheduling app. Customers stopped getting confirmation emails within a week. The app was sending as the contractor's domain, but it was absent from SPF, so inboxes rejected the messages. Adding one include fixed it the same afternoon.

A question owners ask

Can I just set SPF once and forget it?

Every time you add a service that sends email as your domain, SPF needs updating. Set it once, then review it whenever a new tool shows up.