What is SPF? Sender Policy Framework explained

What SPF is for

SMTP lets any server claim to send mail from any address. SPF (Sender Policy Framework) gives domain owners a way to say which servers are allowed to send mail for their domain. A receiving server can then check whether the server it is talking to is on the list.

The current specification is RFC 7208, published in 2014. SPF is one of three checks, with DKIM and DMARC, that mail providers use to judge whether a message really comes from who it claims.

Reading an SPF record

An SPF policy is a TXT record published in DNS at the domain itself. A domain that sends through Google Workspace and a newsletter service might publish:

example.com.  TXT  "v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.10 ~all"

What each part means

v=spf1 marks the record as SPF. include:_spf.google.com says: also allow every server listed in Google's own SPF record. ip4:203.0.113.10 allows one specific address (ip6 works the same way for IPv6). Other mechanisms include a (the domain's own A record) and mx (the domain's mail servers).

The last part, all, says what to do with everyone else. The symbol in front of it sets the result: -all is a hard fail (reject or treat as forged), ~all is a soft fail (accept but treat as suspicious), and ?all is neutral (no opinion). Many domains use ~all and let DMARC decide what to do.

Each domain should have exactly one SPF record. A common mistake is adding a second v=spf1 record for a new service instead of adding another include to the first one, which makes SPF fail.

What SPF checks, and what it misses

SPF checks the envelope sender, the address in the SMTP MAIL FROM command, which shows up as the Return-Path header. It does not check the From address you see in your mail app. A spammer can pass SPF for their own domain while showing your domain in From. DMARC closes that gap by requiring the two domains to match.

SPF also breaks on plain forwarding. When a message is forwarded, it arrives from the forwarder's server, which is not in the original domain's record. DKIM signatures usually survive forwarding, which is one reason domains use both.

To keep DNS load down, SPF allows at most 10 DNS lookups per check. Each include, a, mx and similar mechanism counts, including lookups nested inside included records. Go over the limit and the result is a permanent error.