Wildcard SPF Protection

Why SPF Gaps Are Common

Most teams configure SPF for the apex domain and stop there. They publish a strict policy ending with -all and assume email spoofing is fully addressed.

SPF does not work that way.

SPF policies do not automatically apply to subdomains. If a subdomain has no SPF record, many mail servers treat it as unrestricted. Attackers are well aware of this and actively look for domains where the apex is locked down but subdomains are left open.

They do not need access to your main domain to impersonate your brand.

The Issue This Check Detects

A very common configuration looks like this:

• The apex domain has an SPF record with -all
• No SPF record exists for wildcard subdomains

This creates a gap where attackers can send email from arbitrary subdomains like alerts.example.com or billing.example.com.

To recipients, these emails still look legitimate. From a policy standpoint, the domain is not fully protected.

What This Check Validates

This check looks for SPF coverage beyond the apex domain.

If the apex domain explicitly denies sending but subdomains are not covered by any SPF policy, the check reports missing wildcard protection. It does not assume intent. It highlights exposure.

How to Close the Spoofing Gap

If subdomains should never send email, the safest approach is a wildcard deny.

Wildcard SPF Deny Record

Publish an SPF policy that applies to all subdomains and explicitly denies sending:

# Wildcard SPF record for all subdomains
# This denies email sending from ANY subdomain

*.example.com.  IN  TXT  "v=spf1 -all"

# This tells receiving mail servers that no subdomain
# is authorized to send email unless explicitly stated otherwise

If Some Subdomains Send Email

If some subdomains do send email, the fix needs to be more targeted:

• Publish SPF records only on the subdomains that legitimately send mail
• Keep the apex domain SPF strict
• Do not use a wildcard deny if it would block valid sending

# Example: mail.example.com is allowed to send via a specific provider
# All other subdomains remain denied

# Apex domain - strict policy
example.com.       IN  TXT  "v=spf1 include:_spf.google.com -all"

# Sending subdomain - specific authorization
mail.example.com.  IN  TXT  "v=spf1 include:sendgrid.net -all"

# Wildcard - deny all others
*.example.com.     IN  TXT  "v=spf1 -all"

This approach keeps flexibility while closing the most common spoofing path.