SPF (Sender Policy Framework, RFC 7208) is an email authentication method. The domain owner publishes a TXT record listing the IP addresses and services allowed to send mail for the domain, and receiving servers check the connecting IP against it.
Why it matters
Without SPF, anyone can send mail that claims to be from your domain. Receivers also weigh SPF results when deciding between inbox and spam. SPF checks the envelope sender (Return-Path), not the visible From address, so on its own it does not stop display-name spoofing; DMARC ties the two together.
Example
example.com. 3600 IN TXT "v=spf1 ip4:203.0.113.10 include:_spf.google.com ~all"Mechanisms are checked left to right. ~all is a softfail for anything else; -all is a hard fail. Check with dig +short example.com TXT.
Common mistakes
- Publishing more than one
v=spf1record. Receivers treat that as a permanent error; merge them. - Exceeding the limit of 10 DNS-querying mechanisms (
include,a,mx,ptr,exists,redirect), which also returns a permanent error. - Ending with
+allor?all, which authorizes everyone or nobody in particular. - Forgetting a sender, such as a newsletter or invoicing tool, so its legitimate mail fails.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.