---
title: "Missing or Misconfigured SPF Record"
canonical: "https://kb.cynergy.app/space/MD/899416287/Missing%20or%20Misconfigured%20SPF%20Record"
format: markdown
---
**Description **

SPF Records are used to control what happens when an email comes to the organization from a knowledgeable and unknown source. The Sender Policy Framework (SPF) is an email validation policy to detect crafted emails, or spoofed emails (using the domain of the victim organization). An SPF record contains a list of authorized sending hosts for the domain. It is published as a Domain Name System (DNS) record as a formatted TXT record.

**Hackers View**

As a hacker, I did a simple check using[ SPF records checker](https://www.kitterman.com/spf/validate.html) and was able to see that the SPF record for the victim organization was set as (~all) meaning soft fail. This means for me that there is a good chance my crafted spoofed email will get to the SPAM folder of the victim. If he opens it may lead me to the organization or be the beginning of a great scam.

Finding an organization with no SPF records set is even better, it guarantees that every email I craft even spoofing the CEO or the CFO of the organization, will lend to the victim organization's mailboxes. 

**Mitigation**

Fixing vulnerability requires you to add SPF details on your domain as a TXT record.

It’s advised to refer to the configuration which is supported by your email provider.

- Compile a list of email servers that are authorized to send an email on behalf of the domain. Update the SPF record with the correct email authorization list and use the hard fail flag:  *-all*
- Set an SPF record even for parked domains you own.
- Enable a DMARC policy, and set it to *quarantine* or *reject *emails from unauthorized sources.

**Cynergy’s View**

SPF provides an essential layer of security to emails, preventing hackers from easily getting to the organization's inbox via spoofed emails. 

**Reference**

AWS - [https://docs.aws.amazon.com/ses/latest/dg/send-email-authentication-spf.html](https://docs.aws.amazon.com/ses/latest/dg/send-email-authentication-spf.html) 

GCP - [https://cloud.google.com/dns/docs/records](https://cloud.google.com/dns/docs/records) 

Azure - [https://social.msdn.microsoft.com/Forums/azure/en-US/9bde7626-ac37-4e52-86e2-334a23a1af05/spf-record-on-azure-dns?forum=WAVirtualMachinesVirtualNetwork](https://social.msdn.microsoft.com/Forums/azure/en-US/9bde7626-ac37-4e52-86e2-334a23a1af05/spf-record-on-azure-dns?forum=WAVirtualMachinesVirtualNetwork) 

Cloudflare - [https://www.cloudflare.com/learning/dns/dns-records/dns-spf-record/](https://www.cloudflare.com/learning/dns/dns-records/dns-spf-record/)