What is SPF?
SPF (Sender Policy Framework) is a DNS TXT record that lists the mail servers and services allowed to send email for your domain. Receiving servers compare the sending server's IP address with that list to decide whether a message is authorized, which helps stop spoofing and protects deliverability.
By Stephen Williams · Updated
SPF at a Glance
- Where it lives: One TXT record on your domain itself, starting with v=spf1.
- What it checks: The IP address of the server that sent the message, against the servers and providers your record lists.
- Its limits: It checks the envelope sender, not the From address people see, and it breaks when mail is forwarded. DKIM and DMARC cover those gaps.
How SPF Works
Email Sent
A mail server sends an email claiming to be from your domain. The sending server's IP address is recorded in the email envelope.DNS Lookup
The receiving mail server queries DNS for the SPF record of the sender's domain to retrieve the list of authorized sending IPs.IP Check
The receiver compares the sending server's IP address against the authorized IPs and ranges listed in the SPF record.Result Returned
The SPF check returns a result (pass, fail, softfail, or neutral), which the receiver uses to decide what to do with the message.
SPF Qualifiers
- + (Pass)
- Authorized: accept the email
- - (Fail)
- Not authorized: reject the email
- ~ (SoftFail)
- Probably not authorized: accept but mark
- ? (Neutral)
- No assertion: treat as if no SPF record exists
History Timeline
2003
SPF Concept Introduced
Meng Weng Wong proposed the Sender Policy Framework concept to combat email spoofing by allowing domain owners to declare which IP addresses are permitted to send mail for their domain.2006
RFC 4408 Published
SPF was published as an Experimental RFC (RFC 4408), establishing a formal specification for domain-based email authentication via DNS TXT records.2014
RFC 7208: Proposed Standard
SPF was elevated from Experimental to Proposed Standard with RFC 7208, superseding RFC 4408. This update clarified ambiguities and deprecated the dedicated SPF DNS record type in favor of TXT records.2024
Bulk Sender Requirements
Gmail and Yahoo began requiring SPF and DKIM from bulk senders in February 2024, and Outlook.com followed in May 2025.
Record Mechanisms & Syntax
IP-Based Mechanisms
These mechanisms match the sending server's IP address directly against authorized addresses or ranges.
| Mechanism | What it matches | Example |
|---|---|---|
| ip4 | Match an IPv4 address or CIDR range | ip4:198.51.100.0/24 |
| ip6 | Match an IPv6 address or CIDR range | ip6:2001:db8::/32 |
Domain-Based Mechanisms
These mechanisms resolve a domain name to IP addresses and check against the sender's IP.
| Mechanism | What it matches | Example |
|---|---|---|
| include | Include another domain's SPF record | include:_spf.google.com |
| a | Match the domain's A/AAAA record IPs | a:mail.example.com |
| mx | Match the domain's MX record IPs | mx |
Special Mechanisms & Modifiers
Advanced mechanisms for delegation, conditional checks, and deprecated features.
- redirect
- Delegate evaluation to another domain's record entirely
- exists
- Match if a DNS A record lookup succeeds for the specified domain
- ptr
- Reverse DNS lookup (deprecated: slow and unreliable)
Example Record
v=spf1 ip4:192.0.2.0/24 include:_spf.google.com include:sendgrid.net ~all- v=spf1
- Version identifier (required)
- ip4:192.0.2.0/24
- Authorized IP range
- include:...
- Third-party senders
- ~all
- SoftFail everything else
Why Your Domain Needs Sender Policy Framework
Receivers check SPF on nearly every message they accept. With no SPF record they can't tell your servers from anyone else's, and mail that really is from you is more likely to be filtered.
SPF is also one of the two checks DMARC relies on: DMARC passes when SPF or DKIM passes for the domain in the From address. Gmail, Yahoo and Outlook.com require SPF from bulk senders, alongside DKIM and DMARC.
Setting it up is one TXT record at your DNS provider. The real work is making sure it lists every service that sends as your domain and stays under the 10-lookup limit.
Common Mistakes to Avoid
Exceeding the 10-Lookup Limit
include, a, mx, ptr and exists mechanism and the redirect modifier counts, including lookups inside nested includes. Exceeding it causes a permanent error (PermError), effectively disabling SPF.Using +all
+all authorizes every server on the internet to send as your domain, completely defeating the purpose of SPF. Use -all or ~all instead.Multiple SPF Records
v=spf1 causes a PermError and both are ignored. Merge all mechanisms into a single record.Using the Deprecated ptr Mechanism
ptr mechanism is deprecated in RFC 7208 because it is slow, unreliable, and places a heavy load on DNS infrastructure. Use ip4/ip6 or include instead.Implementation Steps
Inventory Your Sending Sources
List every service and server that sends email for your domain: your mail server, marketing platforms, CRM, transactional email providers, and any third-party applications.Build Your SPF Record
Create a single DNS TXT record starting withv=spf1, followed by mechanisms for each authorized sender, and ending with~allor-all.Publish and Validate
Add the TXT record in your DNS provider, then use our SPF Checker to verify syntax, lookup count, and overall record validity.
SPF FAQ
What is SPF in email?
SPF (Sender Policy Framework) is an email authentication standard that lets a domain owner list which mail servers are allowed to send email for the domain. The list is published as a DNS TXT record that starts with v=spf1, and receiving servers check the sending server's IP address against it.
How does SPF prevent email spoofing?
When a message arrives, the receiving server looks up the SPF record of the domain in the envelope sender (Return-Path) and checks whether the connecting IP address is authorized. If it isn't, SPF fails and the message can be rejected or flagged. SPF doesn't check the visible From address, which is why it is paired with DMARC.
What is the SPF 10-lookup limit?
SPF evaluation is limited to 10 DNS lookups. Each include, a, mx, ptr and exists mechanism and the redirect modifier counts, including lookups inside nested includes. Exceeding the limit causes a permanent error (PermError), which means SPF fails for your domain.
What is the difference between SPF ~all and -all?
~all (softfail) says mail from unlisted servers is probably not authorized and should be accepted but marked, while -all (fail) says it is not authorized and can be rejected. Softfail is common while you confirm every sender. DMARC treats both as an SPF failure, so with DMARC in place your DMARC policy decides what happens.
Do I need SPF if I have DMARC?
Yes. DMARC relies on SPF and DKIM results; without SPF, DMARC can only pass through DKIM. Gmail, Yahoo and Outlook.com also require both SPF and DKIM from bulk senders, so set up SPF, DKIM and DMARC together.
Check Your SPF Record
See your record, its lookup count including nested includes, and anything that would make receivers ignore it.