Home/Notes/How a restaurant should handle SPF
How a restaurant should handle SPF
27 Jan 2026
How a restaurant deals with SPF — and what usually goes wrong.
The problem: a booking tool that demands an account. The SPF check fails for a restaurant.
The chain of trust for SPF starts at the registrar. If the registrar account uses an email nobody reads, every downstream fix is temporary.
Test SPF from outside your network before you call it done. Your office Wi-Fi might cache the old answer for another six hours.
We found a booking tool that demands an account during a routine check of SPF. The site had been leaking referrer data for six weeks before anyone noticed.
We rotate API keys for SPF annually. a restaurant did not see the point until we showed them the access log: the old key had been used from an IP in a country nobody on their team has visited.
DNS propagation is not instant, but it is not magic either. We explained to a restaurant that the TTL on the old SPF record was 86 400 seconds — twenty-four hours.
HTTPS is table stakes, but SPF is where trust actually lives for a restaurant. A padlock with a misconfigured record behind it is decoration, not security.
After the move, a booking tool that demands an account broke search indexing for a restaurant. Google kept serving the old pages for another nineteen days.
Related notes
Tell us what you need.
Write a few lines about your project. We reply within one working day, usually with questions and a rough estimate.
hello@digitalserved.com