What is SPF?
SPF (Sender Policy Framework) is an email authentication protocol that lets domain owners specify which mail servers are authorized to send email on behalf of their domain, preventing spoofing and improving deliverability.
SPF at a Glance
Sender Verification
Confirms that emails come from mail servers you have explicitly authorized to send on your behalf
IP Authorization
Publishes a list of approved sending IP addresses in DNS so receivers can verify legitimacy
Spoofing Prevention
Stops attackers from forging your domain in the envelope sender address of outbound email
How SPF Works
Email Sent
A mail server sends an email claiming to be from your domain. The sending server's IP address is recorded in the email envelope.
DNS Lookup
The receiving mail server queries DNS for the SPF record of the sender's domain to retrieve the list of authorized sending IPs.
IP Check
The receiver compares the sending server's IP address against the authorized IPs and ranges listed in the SPF record.
Result Returned
The SPF check returns a result — pass, fail, softfail, or neutral — which the receiver uses to decide what to do with the message.
SPF Qualifiers
History Timeline
SPF Concept Introduced
Meng Weng Wong proposed the Sender Policy Framework concept to combat email spoofing by allowing domain owners to declare which IP addresses are permitted to send mail for their domain.
RFC 4408 Published
SPF was published as an Experimental RFC (RFC 4408), establishing a formal specification for domain-based email authentication via DNS TXT records.
View RFC 4408RFC 7208 — Proposed Standard
SPF was elevated from Experimental to Proposed Standard with RFC 7208, superseding RFC 4408. This update clarified ambiguities and deprecated the dedicated SPF DNS record type in favor of TXT records.
View RFC 7208Google & Yahoo Mandate SPF
Google and Yahoo began requiring SPF authentication for all bulk senders, making SPF a practical requirement for email deliverability rather than an optional best practice.
Universal Requirement
SPF is now universally required by major email providers. Domains without a valid SPF record face significantly reduced deliverability and are flagged as potential spoofing sources.
Record Mechanisms & Syntax
IP-Based Mechanisms
These mechanisms match the sending server's IP address directly against authorized addresses or ranges.
Domain-Based Mechanisms
These mechanisms resolve a domain name to IP addresses and check against the sender's IP.
Special Mechanisms & Modifiers
Advanced mechanisms for delegation, conditional checks, and deprecated features.
Example Record
Version identifier (required)
Authorized IP range
Third-party senders
SoftFail everything else
Why Your Domain Needs Sender Policy Framework
Prevent Spoofing
Stop attackers from sending fraudulent emails that appear to come from your domain.
Improve Deliverability
Emails from domains with valid SPF records are far less likely to land in spam folders.
DMARC Foundation
SPF is one of two authentication protocols required for DMARC alignment and enforcement.
Industry Compliance
Meet Google, Yahoo, and Microsoft bulk-sender requirements that mandate SPF authentication.
Brand Protection
Protect your brand reputation by ensuring only authorized servers send email as your domain.
Simple Setup
A single DNS TXT record is all it takes — no changes to your mail server software required.
Common Mistakes to Avoid
Exceeding the 10-Lookup Limit
SPF records are limited to 10 DNS lookups. Each include, a, mx, and redirect mechanism counts toward this limit. Exceeding it causes a permanent error (PermError), effectively disabling SPF.
Using +all
Setting +all authorizes every server on the internet to send as your domain, completely defeating the purpose of SPF. Use -all or ~all instead.
Multiple SPF Records
A domain must have exactly one SPF record. Publishing two or more TXT records that start with v=spf1 causes a PermError and both are ignored. Merge all mechanisms into a single record.
Using the Deprecated ptr Mechanism
The ptr mechanism is deprecated in RFC 7208 because it is slow, unreliable, and places a heavy load on DNS infrastructure. Use ip4/ip6 or include instead.
Implementation Steps
Inventory Your Sending Sources
List every service and server that sends email for your domain — your mail server, marketing platforms, CRM, transactional email providers, and any third-party applications.
Build Your SPF Record
Create a single DNS TXT record starting with v=spf1, followed by mechanisms for each authorized sender, and ending with ~all or -all.
Publish and Validate
Add the TXT record in your DNS provider, then use our SPF Checker to verify syntax, lookup count, and overall record validity.
Check Your SPF Record
Use our free SPF checker to validate your domain's SPF record and identify issues before they impact deliverability.