SPF (Sender Policy Framework)

SPF is a DNS-based email authentication mechanism that lets domain owners declare which mail servers are authorized to send email for their domain. Receiving servers check the SPF record and can reject messages from unauthorized sources.

How SPF Works

SPF is published as a TXT record at the domain's apex. When a mail server receives a message, it extracts the envelope sender domain (the MAIL FROM address) and queries that domain's TXT records for one starting with v=spf1. It then evaluates the mechanisms in order, checking whether the sending server's IP matches any of them.

Each mechanism can have a qualifier that determines the result:

• + (Pass) - the IP is authorized. This is the default if no qualifier is specified.
• - (Fail) - the IP is explicitly not authorized. Reject the message.
• ~ (SoftFail) - the IP is probably not authorized. Accept but mark as suspicious.
• ? (Neutral) - no assertion is made about this IP.

SPF Syntax

An SPF record is a single TXT record containing a space-separated list of mechanisms. Here is a typical example:

v=spf1 include:_spf.google.com ip4:203.0.113.0/24 -all

This record authorizes Google's mail servers (via the include mechanism) and any server in the 203.0.113.0/24 range. The -all at the end means all other sources should fail.

Common mechanisms:

• ip4: / ip6: - match a specific IP address or CIDR range.
• include: - recursively evaluate the SPF record of another domain.
• a - match the domain's own A record IP.
• mx - match the IPs of the domain's MX servers.
• all - matches everything. Used at the end as the default action.

Common Failures

• Too many DNS lookups. SPF evaluation is limited to 10 DNS lookups (includes, a, mx, and redirect mechanisms each count). Exceeding this limit causes a PermError, and many receivers treat that as a fail. This is the single most common SPF problem for organizations using multiple SaaS email senders.
• Missing include for third-party senders. If you send email through a transactional service like Mailgun or SendGrid, you need their include: in your SPF record. Forgetting this causes those emails to fail SPF.
• Using ~all instead of -all. SoftFail (~all) tells receivers to accept the message anyway, which significantly reduces SPF's protective value. Use -all once you are confident your record is complete.

SPF Alone Is Not Enough

SPF only validates the envelope sender (the MAIL FROM domain), not the From: header that users see. An attacker can spoof the visible From address while using a different envelope sender that passes SPF. To close this gap, you need DKIM to sign the message body and DMARC to enforce alignment between the visible From domain and the domains authenticated by SPF and DKIM.

Validate your SPF record with the DNS tool →