SPF (Sender Policy Framework)
SPF is an email authentication standard that lists, in your DNS, exactly which mail servers are allowed to send messages for your domain — so receivers can reject mail from any server not on that list.
How SPF works
SPF is a single TXT record in your DNS that names the IP addresses and services permitted to send email using your domain in the envelope sender. When a receiving server gets a message, it checks the sending server's IP against that list. If it matches, SPF passes; if not, the receiver treats the mail as suspicious.
SPF validates the envelope (return-path) domain, not the visible From address — which is why it works together with DKIM and DMARC rather than on its own.
Why SPF matters
- Blocks the simplest form of domain spoofing at the server level
- One of the two ways a message can achieve DMARC alignment
- Expected by every major mailbox provider; a missing or broken SPF record hurts placement
- Cheap to publish and maintain — a single DNS record covers your whole domain
Common SPF pitfalls
- The 10 DNS-lookup limit: too many 'include' statements make SPF fail with a permerror
- Multiple SPF records on one domain — only one TXT SPF record is allowed
- Forgetting to add a new sending service, so its mail silently fails authentication
- Using '+all' (allow anyone), which defeats the purpose; end with '~all' or '-all'
Frequently asked questions
What does '~all' vs '-all' mean in SPF?
'-all' (hard fail) tells receivers to reject unlisted servers; '~all' (soft fail) says treat them as suspicious but usually accept. Most senders start with '~all' and tighten to '-all' once confident.
How many SPF records can I have?
Exactly one per domain. If you use several sending services, merge them into a single record with multiple 'include' statements — within the 10-lookup limit.
Does SPF survive email forwarding?
Often not — forwarding changes the sending server, breaking SPF. DKIM survives forwarding, which is why DMARC accepts either one passing with alignment.
Start sending in minutes
Create a free account, connect your domain and reach your audience across every channel — no credit card needed.
Free plan forever · No credit card required · Set up in minutes