Definition
SPF (Sender Policy Framework) is an email authentication protocol that allows domain owners to specify which mail servers are permitted to send email from their domain. It works by publishing DNS records that list authorised sending IP addresses, enabling receiving servers to verify that incoming messages come from legitimate sources.
SPF is one of the three core email authentication protocols alongside DKIM and DMARC. It is the oldest and most widely implemented, but it has limitations that DKIM and DMARC were designed to address.
How SPF Works
- A domain owner publishes an SPF record in their DNS as a TXT record
- When a receiving server gets an email, it looks up the SPF record for the domain in the envelope sender address
- The server checks the sending IP against the authorised IPs listed in the SPF record
- If the IP matches, SPF passes. If not, SPF fails
- The receiving server uses the SPF result along with other authentication signals to determine how to handle the message
SPF Record Format
An SPF record is a TXT record in DNS that starts with v=spf1 followed by mechanisms that define authorised senders:
v=spf1 include:_spf.google.com include:sendgrid.net ~all
| Mechanism | Description | Example |
|---|---|---|
include: |
Delegates authorisation to another domain's SPF record | include:_spf.google.com |
ip4: |
Authorises a specific IPv4 address or range | ip4:192.0.2.0/24 |
ip6: |
Authorises a specific IPv6 address or range | ip6:2001:db8::/32 |
a |
Authorises the domain's A record IP | a |
mx |
Authorises the domain's MX server IPs | mx |
all |
Default rule for all IPs not matched above | ~all or -all |
SPF Qualifiers
Every mechanism can have a qualifier that tells the receiving server what to do:
| Qualifier | Meaning | Action |
|---|---|---|
+ |
Pass | Authorised sender |
~ |
SoftFail | Probably not authorised, but accept it |
- |
Fail | Not authorised, reject it |
? |
Neutral | No statement about authorisation |
Most domains use ~all to avoid rejecting legitimate email that might be sent from unlisted servers.
Common SPF Issues
- Too many DNS lookups: SPF has a limit of 10 DNS lookups per record. Exceeding this causes SPF to return a permanent error (PermError)
- Missing include statements: Third-party services like SendGrid, Mailchimp, or Google Workspace must be included in the SPF record
- SPF alignment failure: SPF only checks the envelope sender domain, not the visible From header. This is why DMARC alignment is needed
Was this useful?
Related Glossary Terms
A/B Testing
A/B testing in email marketing is the practice of sending two variations of an email to a small sample of your list to determine which version performs better before sending the winner to the remaining subscribers.
Abandoned Cart Email
An abandoned cart email is an automated message sent to customers who added items to their online shopping cart but left without completing the purchase. It is one of the highest-converting email types in ecommerce.
Abuse Complaint
An abuse complaint is a report from a recipient who marks an email as spam, which negatively affects sender reputation and deliverability.
AI Email Summary
An AI email summary is a short, machine-generated overview of an email's key points, shown by Gmail, Outlook and Apple Mail before a recipient opens the message. It is reshaping how email marketers think about subject lines, preview text and open rates.
AI Inbox Summary
An AI inbox summary is an AI-generated digest that condenses unread email — often highlighting news, actions and senders — changing how clearly your marketing email reaches and engages subscribers.
AI Inbox
An AI inbox is an email client that uses artificial intelligence to summarise, sort, prioritise and sometimes answer emails before the human recipient reads them. It is transforming email marketing metrics and copywriting.
Frequently Asked Questions
Major mailbox providers including Gmail and Outlook require SPF (along with DKIM and DMARC) for reliable delivery. Unauthenticated email is increasingly likely to be rejected or filtered to spam.
Use online tools like MXToolbox, DNSTools, or Google Admin Toolbox to look up your domain's SPF record. You can also use a command-line tool like `dig TXT yourdomain.com | grep spf` to check from your terminal.
SPF records can include a maximum of 10 DNS lookups (including lookups triggered by `include:` statements and other mechanisms). Exceeding this limit causes SPF to return a PermError, which means the authentication check fails. Consolidate include statements and use IP ranges where possible to reduce the lookup count.
`~all` means soft fail — the email should be accepted but marked as suspicious. `-all` means hard fail — the email should be rejected. Most domains use `~all` because `-all` can cause legitimate email to be rejected if the SPF record is incomplete or incorrectly configured.
No. SPF has a significant weakness: it only checks the envelope sender domain, not the visible From header. A sophisticated spoofer can pass SPF while displaying a fake From address. This is why DMARC with alignment checking is necessary for full email authentication.