Skip to content
mailprompt
Start free trial
GlossaryUpdated

What is SPF?

SPF is a DNS record that lists the servers authorized to send email for a domain. A receiving server checks the envelope sender against the record. SPF helps with authentication, but it can break on forwarding and it is limited to a small number of DNS lookups.

Key facts

  • RFC 7208 defines Sender Policy Framework and the ten-DNS-lookup limit for an SPF evaluation. Source
  • Google asks bulk senders to authenticate with SPF as part of its sender guidelines. Source
  • DMARC can pass when either SPF or DKIM aligns with the From domain. Source

What SPF is

This definition is part of the Mailprompt glossary. SPF stands for Sender Policy Framework. It is a DNS record that tells receiving servers which systems are allowed to send email for a domain.

The record is a TXT record at the domain root. It starts with v=spf1 and lists mechanisms. A receiving server checks the envelope sender against those mechanisms and records a pass, fail, soft fail or neutral result.

The parts of a record

An include mechanism points at another domain's SPF record. A sender that uses a third-party platform adds that platform's include. An ip4 or ip6 mechanism authorizes a specific address. An mx mechanism authorizes the domain's mail exchangers.

The all mechanism applies to anything that did not match earlier. The qualifier in front of it decides what happens to an unmatched sender. A tilde is a soft fail; a minus is a hard fail. A hard fail is stronger, but it is also less forgiving of a missing sender.

One record, ten lookups

A domain should have one SPF record. Two v=spf1 records at the same name produce a permanent error. The correct approach is to merge the mechanisms into one record.

RFC 7208 limits the evaluation to ten DNS lookups. Every include can cost lookups, and an include can point at a record with more includes. A long chain can exceed the limit even when each individual include is valid.

The practical rule is to keep the record short. Remove senders you no longer use and check the lookup count before adding another include. If the record cannot fit, move a sender to a subdomain with its own record.

SPF and forwarding

SPF checks the envelope sender, which forwarding can change. A message that passed SPF at the original sender can fail after a forwarder rewrites the envelope. That is one reason DKIM matters: a signed message can still authenticate after some forwarding paths.

DMARC can pass when either SPF or DKIM aligns with the From domain. A domain with SPF only is more fragile than a domain with both.

Editing safely

Before you edit an SPF record, copy the current value. Add one include at a time and verify the result. If the new record fails, put the old one back. Do not create a second record to solve a merge problem.

The record is part of the domain's authentication system, not a one-time setup. A new sender, a retired tool or a changed platform all require a review.

Frequently asked questions

What does ~all mean at the end of an SPF record?

The all qualifier applies to senders that do not match any earlier mechanism. A tilde means soft fail: the receiver may accept the message but mark it as suspicious. A minus means hard fail: the receiver should reject it. A question mark is neutral and a plus is a pass. Most domains start with a soft fail while they confirm their senders.

How many DNS lookups does SPF allow?

RFC 7208 limits an SPF evaluation to ten DNS lookups. Includes, redirects and other mechanisms can each consume lookups, and an include can consume more than one. A record that exceeds the limit can fail even when every sender is legitimate. Keep the record short and remove unused includes.

What is the difference between SPF and DKIM?

SPF authorizes servers based on the envelope sender. DKIM signs the message and can survive some forwarding. DMARC can pass if either SPF or DKIM aligns with the From domain. That is why a complete setup publishes both and adds a DMARC policy.

Sources