What is it?
This mail DNS finding means the domain has no SPF TXT record. SPF lists which hosts are allowed to send mail using the domain in the envelope sender or HELO identity.
Why does it matter?
Without SPF, receivers cannot use SPF to distinguish legitimate senders from unauthorized senders. DMARC can still pass through aligned DKIM, but missing SPF removes one major authentication path and weakens spoofing protection.
How to fix it?
Publish exactly one SPF TXT record for the domain used by your mail platform. Include all legitimate senders and end with a policy qualifier.
example.com. 3600 IN TXT "v=spf1 ip4:203.0.113.20 include:_spf.provider.example -all"Use ~all while migrating if you are unsure about every sender. Move to -all after confirming that all legitimate mail sources are included.