Glossary / SPF

SPF record: what it is and how it works

SPF (Sender Policy Framework) is a TXT record in your domain's DNS that lists the servers allowed to send email on its behalf. Mail providers check it to tell your real messages apart from spoofed ones. Without a correct SPF record, your mail lands in spam more often and anyone can forge your address.

You publish one TXT record that starts with v=spf1 and list the services allowed to send your mail: your host, a newsletter tool, Google Workspace and so on. When another server receives a message that claims to be from your domain, it reads this record and compares the sender's IP against the list.

If the IP is on the list, the message passes; if not, it is flagged as suspicious. The record ends with ~all (softfail) or -all (hardfail), which tells receivers what to do with any server that is not listed.

One catch: SPF checks the technical sender address (Return-Path), not the From line a person actually sees. That is why SPF works together with DKIM and DMARC rather than on its own.

Example

v=spf1 include:_spf.google.com include:spf.tomishost.com ~all

Common mistakes

• Two v=spf1 records on one domain break the check; only one is allowed.
• Ending with +all leaves the door open for anyone to send as you.
• More than 10 DNS lookups (too many include:) makes SPF fail with permerror.
• Assuming SPF alone stops spoofing of the visible From: that job belongs to DMARC.

Related terms

• DKIM DKIM: the digital signature on your mail
• DMARC DMARC: the rule for mail that fails checks