highSeverity: highRisk ratingHow usable this gap is to an attacker. Severity sets the posture penalty: critical −40, high −20, medium −10, low −4, info −1. Higher severity means fix it sooner.DNS · TXTWhere it livesImplementationThis fix is applied in: DNS · TXT. That's the surface you'll edit, DNS, response headers, or a static file.~5 minTime to fixEffortRoughly 5 minutes of hands-on work, propagation aside. Most of these are copy-paste.+10 posture+10 postureScore impactPoints this fix recovers in the ApeCyber posture score (0–100). Posture = 100 minus the severity penalty of every open finding; clearing this finding adds these points back.

SPF: stop attackers sending email as your domain

Your domain is a free phishing toolkit until you publish SPF

The threat

If you have no SPFSPFEmail authSender Policy Framework: a DNS record listing which mail servers are allowed to send email as your domain, so spoofed senders get flagged. record, anyone on the internet can send email that says it’s from you@yourdomain.com, and receiving mail servers have no way to know it’s fake. This is how invoice fraud, CEO-impersonation, and customer phishing start. The attacker doesn’t need to hack you. They just need your domain to stay silent.

SPF (Sender Policy Framework) is you publishing, in public DNSDNSInfrastructureThe Domain Name System, the internet's address book. It's also where you publish the SPF, DKIM, DMARC and CAA records that secure your domain., the list of servers allowed to send as your domain. Everything else is suspect.

The exact fix

We run Google Workspace (your MX records point at aspmx.l.google.com). Add one DNS record:

FieldValue
TypeTXT
Name@ (the apex, your bare domain)
Valuev=spf1 include:_spf.google.com ~all
TTL3600

That’s the entire fix. include:_spf.google.com authorizes Google to send as you; ~all~allSPF qualifierThe SPF 'soft fail' qualifier: mail from servers not on your list is marked suspicious rather than hard-rejected, the recommended starting posture. soft-fails everyone else (the safe starting posture).

One SPF record only. A domain may have exactly one v=spf1 record. If one already exists, do not add a second, merge the include: mechanisms into the single record, or it breaks.

Verify it

dig +short TXT yourdomain.com | grep spf1

You should see your record echoed back:

"v=spf1 include:_spf.google.com ~all"

Why it matters next

SPF alone isn’t the whole story, it protects the visible envelope, but breaks on forwarding. It’s step one of the email-authentication trio. Pair it with DKIM (cryptographic signing) and enforce both with DMARC. Together they make your domain genuinely un-spoofable.

Proof

On our own property, dev3lop.com, publishing SPF + DMARCDMARCEmail authDomain-based Message Authentication: a DNS policy telling receivers what to do with mail that fails SPF or DKIM, and which emails you a report of everyone spoofing you. cleared the only High-severity finding on the site and moved its posture out of the “spoofable” tier in minutes, part of the run from grade E (54) to A (100).