SPF

What SPF is

Sender Policy Framework is a published list of the mail servers allowed to send email on behalf of a domain. The list lives in a TXT record at the domain's root and looks like this:

v=spf1 ip4:203.0.113.0/24 include:_spf.example-provider.com -all

When a receiving server gets a message, it takes the domain from the envelope sender (the MAIL FROM address, which can differ from the visible From: header), fetches the SPF record, and checks whether the connecting server's IP is on the list. -all at the end means "anything not listed should fail"; ~all means "treat it as suspicious but accept"; +all means "anyone may send", which is the same as having no record.

Reading the mechanisms

• ip4: and ip6: list addresses or CIDR ranges directly.
• a and mx authorize the domain's A record and MX hosts.
• include: pulls in another domain's record, used for third-party senders.
• redirect= hands the whole evaluation to another domain.

A record may cause at most ten DNS lookups during evaluation; include, a, mx, and redirect each count. Exceeding the limit produces a permanent error and the check fails, which is the most common SPF problem on domains that use several sending services.

Why it matters

Without SPF, anyone can send mail that claims to come from your domain, and receivers have no cheap way to tell. With it, forged mail from unauthorized servers fails the check. SPF alone does not protect the visible From: address, which is what people actually read; that is the job of DMARC, which ties SPF and DKIM results to the header domain. A domain that sends mail should have all three.

How to check

Use the DNS lookup tool with the type set to TXT and look for the record beginning with v=spf1. There must be exactly one; two SPF records are an error that causes the check to fail. Then paste a message's headers into the email header analyzer to see the Received-SPF or Authentication-Results line a receiver added, which tells you how the record was actually evaluated for a real message.

Common misconceptions

SPF does not sign or encrypt anything, and it breaks when mail is forwarded, because the forwarding server is not on the original domain's list. That is why DKIM, which survives forwarding, is the second half of the picture.