Email Security

What Is SPF?

How Sender Policy Framework protects your domain from spoofing.

Ohidur Rahman

— 5 min read
Share

SPF (Sender Policy Framework) is an email authentication protocol that helps prevent unauthorised senders from sending email on behalf of your domain. It works by publishing a DNS record that lists which mail servers are permitted to send email for your domain.

When a receiving mail server gets a message claiming to be from your domain, it checks your SPF record to verify whether the sending server is authorised. If the server is not listed, the message can be flagged as suspicious or rejected.

SPF is one of the three core email authentication protocols — alongside DKIM and DMARC — that every business domain should have configured.

Why SPF Matters for Your Business

Without an SPF record, anyone can send email that appears to come from your domain. This is called email spoofing, and it is one of the most common techniques used in phishing attacks and email fraud.

Here is what can happen if your domain does not have SPF configured:

  • Attackers can send fake emails that look like they come from your company
  • Your customers or partners may receive fraudulent messages using your domain
  • Your legitimate emails are more likely to be flagged as spam or rejected
  • Your domain’s reputation can be damaged, making future email delivery harder

Setting up SPF does not guarantee that every email you send will reach the inbox, but it is a fundamental step in establishing your domain’s credibility with receiving mail servers.

How SPF Works

SPF works through a simple verification process:

  1. You publish an SPF record in your domain’s DNS settings. This record lists the IP addresses and mail servers that are allowed to send email on behalf of your domain.
  2. When someone receives an email from your domain, their mail server looks up your SPF record.
  3. The receiving server checks whether the IP address of the server that sent the message matches one of the authorised senders in your SPF record.
  4. If the IP address matches, the SPF check passes. If it does not match, the check fails.

What happens after a failed SPF check depends on your DMARC policy. The message might be delivered anyway, sent to spam, or rejected outright.

What an SPF Record Looks Like

An SPF record is a TXT record added to your domain’s DNS. Here is a typical example:

v=spf1 include:mail.emailprovider.com ip4:203.0.113.5 -all

Let’s break this down:

  • v=spf1 — identifies this as an SPF record (version 1)
  • include:mail.emailprovider.com — authorises the mail servers used by your email hosting provider
  • ip4:203.0.113.5 — authorises a specific IP address to send email for your domain
  • -all — tells receiving servers to reject any email from servers not listed in this record

SPF Mechanisms Explained

SPF records use several mechanisms to define which servers are authorised:

include

Authorises the servers listed in another domain’s SPF record. This is commonly used when you send email through a third-party service. For example, if your email hosting provider is emailprovider.com, you would add include:emailprovider.com to your SPF record.

ip4 and ip6

Authorises a specific IPv4 or IPv6 address. Use this when you know the exact IP address of a server that sends email on your behalf.

a

Authorises the server at the IP address your domain’s A record points to. This is useful if your web server also sends email.

mx

Authorises the servers listed in your domain’s MX records. This is useful when your incoming and outgoing mail servers are the same.

The all Mechanism

The all mechanism at the end of an SPF record defines what happens to messages from servers that are not listed. There are three common options:

  • -all (hard fail) — reject email from unauthorised servers. This is the strictest and recommended setting
  • ~all (soft fail) — accept email from unauthorised servers but mark it as suspicious. This is useful during initial setup when you are still identifying all your sending sources
  • ?all (neutral) — no opinion on unauthorised servers. This effectively disables SPF enforcement and is not recommended

For most businesses, -all is the correct choice once all legitimate sending sources have been added to the record.

Common SPF Mistakes

Too Many DNS Lookups

SPF has a limit of 10 DNS lookups per record. Each include mechanism counts as one lookup, and nested includes count too. If your record exceeds 10 lookups, the SPF check will fail for all messages. This commonly happens when businesses use multiple third-party services that each require their own include statement.

Multiple SPF Records

A domain should have only one SPF record. If you have two TXT records that both start with v=spf1, SPF validation will fail. If you need to authorise additional servers, add them to your existing record rather than creating a new one.

Using +all

Setting +all at the end of your SPF record means you are authorising every server in the world to send email as your domain. This completely defeats the purpose of SPF and should never be used.

Forgetting Third-Party Senders

If your business uses services that send email on your behalf — such as a CRM, marketing platform, invoicing tool or helpdesk — those services need to be included in your SPF record. If they are not, emails sent through those services may fail SPF checks.

How SPF Works with DKIM and DMARC

SPF is most effective when used alongside DKIM and DMARC. Each protocol covers a different aspect of email authentication:

  • SPF verifies that the sending server is authorised to send email for the domain
  • DKIM verifies that the message content has not been altered in transit
  • DMARC ties SPF and DKIM together and tells receiving servers what to do when checks fail

On their own, each protocol has limitations. Together, they provide a comprehensive system for verifying that email from your domain is legitimate.

How to Check Your SPF Record

You can check whether your domain has an SPF record and whether it is valid using several methods:

Online Tools

MXToolbox SPF Lookup, Google Admin Toolbox, and dmarcian are popular tools that let you enter your domain and see your current SPF record, along with any errors or warnings.

Command Line

On macOS or Linux:

dig yourcompany.com TXT | grep spf

On Windows:

nslookup -type=txt yourcompany.com

Look for the TXT record that starts with v=spf1.

Setting Up SPF for Your Domain

To set up SPF, you need to:

  1. Identify all servers and services that send email on behalf of your domain
  2. Create a TXT record in your domain’s DNS with the appropriate SPF syntax
  3. Start with ~all (soft fail) while you verify everything is working
  4. Switch to -all (hard fail) once you are confident all senders are listed
  5. Monitor your email delivery and DMARC reports for any issues

If you are unsure which services send email for your domain, DMARC reports can help you identify them.

Summary

SPF is a foundational email authentication protocol that tells receiving mail servers which servers are allowed to send email for your domain. It helps prevent spoofing, protects your brand, and improves the chances of your legitimate emails being delivered.

Every business domain that sends email should have an SPF record configured correctly. It is one of the simplest and most effective steps you can take to secure your business email.

Need help setting up SPF for your domain? Contact our team and we’ll configure it as part of your email security setup.

Read more