Cybersecurity
Email remains the primary attack vector for cybercriminals targeting small businesses, and your organisation's reputation is only as secure as your email infrastructure. SPF records for small business are one of the most underutilised yet critical defences available, yet many London SMBs operate without them—or worse, with misconfigured ones. Whether you're in professional services, legal practice, or financial advisory, email authentication isn't optional anymore; it's essential. This guide walks you through configuring SPF records properly, ensuring your business emails reach inboxes whilst protecting your domain from spoofing and impersonation attacks.
Sender Policy Framework (SPF) is a DNS authentication protocol that prevents bad actors from sending emails on behalf of your domain. When someone claims to send an email "from" your organisation, receiving mail servers check your SPF record to verify that the sending server is authorised to do so.
Think of it this way: without SPF, anyone can claim to be your company in an email header. A criminal could impersonate your managing director asking for urgent funds transfer, or pose as a trusted partner requesting sensitive information. SPF adds a cryptographic layer of verification that's checked automatically by email providers.
For professional services firms, legal practices, and financial advisers, the stakes are particularly high. Client trust depends on secure communications. A single spoofed email pretending to be from your firm could result in:
SPF records are free to implement and take less than an hour to configure correctly—yet they're your first line of defence in email authentication. DMARC and DKIM provide additional layers, but SPF is the logical starting point.
SPF records live in your domain's DNS settings and follow a specific format. Here's a simple example:
v=spf1 include:_spf.google.com ~all
Let's break down what this means:
The final mechanism is crucial. -all (hardfail) means "reject any email not explicitly authorised." ~all (softfail) is more lenient and is recommended during initial setup. You can transition to hardfail once you've tested thoroughly.
1. Identify all your email sources
Before writing any SPF record, list every service that sends emails on behalf of your domain:
This is critical. If you forget to authorise a legitimate sender, their emails may be rejected or marked as spam.
2. Locate your DNS provider and access settings
Your DNS is typically managed through:
Log in and find the DNS records section—you'll be looking for an option to create or edit TXT records.
3. Build your SPF record string
Most email providers publish SPF include strings in their documentation. For example:
A typical SMB record might look like this:
v=spf1 include:_spf.google.com include:hubspotemail.net include:sendgrid.net ~all
4. Add the record to DNS
Create a new TXT record with:
Save and allow 24–48 hours for DNS propagation globally, though many providers update within minutes.
5. Test your record
Use free SPF checking tools like MXToolbox or Google's Admin Toolbox to verify your record is published and correctly formatted. These tools will also alert you to common errors, such as exceeding the 10 DNS lookup limit (a technical constraint that can invalidate complex SPF records).
Even well-intentioned implementations often contain errors that reduce effectiveness:
SPF is foundational, but it's not the complete solution. Email impersonation can be sophisticated. Genuine defence requires a layered approach:
VP Shield runs six passive checks across DNS, TLS, headers, SPF, DKIM, DMARC and subdomain takeover — no login, no install, no port scans. Results in 15 seconds.
Scan your domain now →