Check that your mail provider is listed in the SPF record

email.spf.provider_missing · effort: minutes

Why it matters

The MX records show that Google Workspace or Microsoft 365 hosts your mail, but the SPF record does not include that provider's sending servers, so mail it sends for you can fail SPF and depend on DKIM alone. The scan cannot see who sends for you, so this is a prompt to check, not a proven fault.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Find out whether your provider sends your outgoing mail (it does when you write from the Gmail or Outlook web app or from a mail program connected to the account). If mail only leaves through other services that are already in the record, leave it as it is.
  2. Add the provider's include inside the existing v=spf1 record, before the final all: include:_spf.google.com for Google Workspace, include:spf.protection.outlook.com for Microsoft 365. Do not add a second v=spf1 record.
  3. The +mx or +a terms do not cover this: they authorise the servers that receive your mail, not the ones the provider sends from.
  4. Re-scan afterwards and watch the SPF lookup count, which must stay at 10 or below.
dns 
; Google Workspace
example.com.  IN TXT  "v=spf1 include:_spf.google.com ~all"
; Microsoft 365
example.com.  IN TXT  "v=spf1 include:spf.protection.outlook.com ~all"

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.