Home / Knowledge hub / SPF
Knowledge hub
SPF
A DNS record listing which servers may send email for your domain.
What it means
SPF stands for Sender Policy Framework. It is a TXT record in your domain’s DNS that lists the servers allowed to send email using that domain. A receiving mail server looks up the record, compares it with the server that delivered the message, and decides whether the sender is authorised.
The record starts with v=spf1 and lists permitted sources, such as an include: for your email provider, then ends with a rule for everything else. SPF checks the envelope sender used during delivery, which can differ from the From address a person sees in their inbox.
Why it matters
Without SPF, anyone can send mail that claims to come from your domain, and receivers have little to judge it by. That helps phishing and spoofing against your customers and staff, and it damages your reputation so that real invoices land in spam.
SPF has limits. Because it checks only the envelope sender, it does not stop a forged visible From address on its own. It also breaks when a message is forwarded, since the forwarder’s server is not in your list. That is why it is paired with DKIM and DMARC.
How it shows up
The record ends with an all rule. A hyphen (-all) tells receivers to reject mail from other sources, a tilde (~all) marks it as suspicious, and a plus or missing rule allows everything. Every sending service you use, from marketing tools to your product’s own notifications, has to be included.
The common mistakes: more than ten DNS lookups, which makes the record invalid; two SPF records on one domain; leaving out a third-party sender; and a permissive ending. Check by sending test mail and reading the headers, and review the record whenever you add or drop an email service.
Questions people ask
SPF, answered
What does an SPF record look like?
A single TXT record such as v=spf1 include:_spf.example.com -all. It lists the allowed senders and ends with a policy for everything else.
A domain should publish only one SPF record, never two.
What is the 10 lookup limit?
SPF allows at most ten DNS lookups while evaluating a record. Each include, a, mx and similar term counts, and going over makes the result a permanent error.
Too many email services in one record is the usual cause.
Is SPF enough to stop spoofing?
No. SPF does not check the From address a user sees, and forwarding can break it. Use it with DKIM and a DMARC policy that checks alignment.
The three work as a set.
What is the difference between -all and ~all?
The hyphen asks receivers to fail mail from unlisted sources, and the tilde asks them to treat it as a soft failure. Once you are sure the list is complete, the hyphen is firmer.
DMARC policy decides the final action in many cases.
Do subdomains need their own SPF record?
Yes, if they send mail. SPF is checked per domain name, so a record on the main domain does not cover a subdomain.
Domains that never send mail should publish a record that allows nothing.
Sources
Where this comes from
Related
Terms that sit next to this one
DKIM
A signature on outgoing email that proves it came from your domain and is unaltered.
DMARC
A DNS policy telling receivers what to do with email that fails SPF and DKIM.
Email spoofing
Sending email that appears to come from your domain when it does not.
Phishing
Persuading someone to hand over credentials by posing as a trusted sender.
DNS security
Protecting the lookup system that turns your domain name into a server address.
Are all your senders on the list?
SPF is DNS and mail setup, not application code, so it sits outside our tests. Where your product sends email, we check the web app and API, including cross-account access. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.