Definition
SPF (Sender Policy Framework) is an email authentication protocol that allows domain owners to specify which mail servers are permitted to send email from their domain. It works by publishing DNS records that list authorised sending IP addresses, enabling receiving servers to verify that incoming messages come from legitimate sources.
SPF is one of the three core email authentication protocols alongside DKIM and DMARC. It is the oldest and most widely implemented, but it has limitations that DKIM and DMARC were designed to address.
How SPF Works
- A domain owner publishes an SPF record in their DNS as a TXT record
- When a receiving server gets an email, it looks up the SPF record for the domain in the envelope sender address
- The server checks the sending IP against the authorised IPs listed in the SPF record
- If the IP matches, SPF passes. If not, SPF fails
- The receiving server uses the SPF result along with other authentication signals to determine how to handle the message
SPF Record Format
An SPF record is a TXT record in DNS that starts with v=spf1 followed by mechanisms that define authorised senders:
v=spf1 include:_spf.google.com include:sendgrid.net ~all
| Mechanism | Description | Example |
|---|---|---|
include: |
Delegates authorisation to another domain's SPF record | include:_spf.google.com |
ip4: |
Authorises a specific IPv4 address or range | ip4:192.0.2.0/24 |
ip6: |
Authorises a specific IPv6 address or range | ip6:2001:db8::/32 |
a |
Authorises the domain's A record IP | a |
mx |
Authorises the domain's MX server IPs | mx |
all |
Default rule for all IPs not matched above | ~all or -all |
SPF Qualifiers
Every mechanism can have a qualifier that tells the receiving server what to do:
| Qualifier | Meaning | Action |
|---|---|---|
+ |
Pass | Authorised sender |
~ |
SoftFail | Probably not authorised, but accept it |
- |
Fail | Not authorised, reject it |
? |
Neutral | No statement about authorisation |
Most domains use ~all to avoid rejecting legitimate email that might be sent from unlisted servers.
Common SPF Issues
- Too many DNS lookups: SPF has a limit of 10 DNS lookups per record. Exceeding this causes SPF to return a permanent error (PermError)
- Missing include statements: Third-party services like SendGrid, Mailchimp, or Google Workspace must be included in the SPF record
- SPF alignment failure: SPF only checks the envelope sender domain, not the visible From header. This is why DMARC alignment is needed
Related Glossary Terms
A/B Testing
A/B testing in email marketing is the practice of sending two variations of an email to a small sample of your list to determine which version performs better before sending the winner to the remaining subscribers.
Abandoned Cart Email
An abandoned cart email is an automated message sent to customers who added items to their online shopping cart but left without completing the purchase. It is one of the highest-converting email types in ecommerce.
AIDA Model for Email
The AIDA model (Attention, Interest, Desire, Action) is a classic copywriting framework used to structure email campaigns that guide subscribers from awareness to conversion.
AMP for Email
AMP for Email is a Google-developed framework that allows email messages to include interactive elements like forms, carousels, accordions, and live content. It turns static emails into dynamic, interactive experiences directly inside the inbox.
Announcement Email
An announcement email is a dedicated campaign that communicates a specific update, milestone, or change to subscribers, from product launches and feature releases to company news and events.
AOL Mail for Email Marketers
AOL Mail is a legacy email provider with specific deliverability requirements and rendering quirks, now operating as part of the Yahoo+AOL network under shared infrastructure.
Frequently Asked Questions
Major mailbox providers including Gmail and Outlook require SPF (along with DKIM and DMARC) for reliable delivery. Unauthenticated email is increasingly likely to be rejected or filtered to spam.
Use online tools like MXToolbox, DNSTools, or Google Admin Toolbox to look up your domain's SPF record. You can also use a command-line tool like `dig TXT yourdomain.com | grep spf` to check from your terminal.
SPF records can include a maximum of 10 DNS lookups (including lookups triggered by `include:` statements and other mechanisms). Exceeding this limit causes SPF to return a PermError, which means the authentication check fails. Consolidate include statements and use IP ranges where possible to reduce the lookup count.
`~all` means soft fail — the email should be accepted but marked as suspicious. `-all` means hard fail — the email should be rejected. Most domains use `~all` because `-all` can cause legitimate email to be rejected if the SPF record is incomplete or incorrectly configured.
No. SPF has a significant weakness: it only checks the envelope sender domain, not the visible From header. A sophisticated spoofer can pass SPF while displaying a fake From address. This is why DMARC with alignment checking is necessary for full email authentication.