EMAIL-001: SPF Record Validation
- Platform
- Google Workspace
- Category
- Advanced Threat Protection
- Severity
- Critical
- Zero Trust pillar
- Applications & Workloads (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Sender Policy Framework (SPF) records must exist and be valid for all domains. SPF prevents email spoofing by specifying which mail servers are authorized to send email on behalf of a domain
Recommended value
Valid v=spf1 record published for all domains with -all or ~all qualifier
Remediation
Admin Console > Apps > Google Workspace > Gmail > Authenticate email > Publish SPF record: v=spf1 include:_spf.google.com ~all for each domain
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- SI-8, SC-7
- CIS Benchmark
- 2.1
- CISA SCuBA
- GWS.GMAIL.3.1v1
- MITRE ATT&CK
- T1566.001, T1566.002