emailrules.today
Stop 3 of 8Week oneMilliseconds

SPF

A public DNS list of servers allowed to send mail for your domain.

Say it out loud

“A public list of the servers allowed to send as us. Anything else looks like a forgery.”

SPF (Sender Policy Framework) is a DNS record naming which mail servers may send email for your domain. Receivers check the sending server's address against it. Your platform tells you what to add; publishing it is yours, and there can only ever be one SPF record on a domain.

10
maximum DNS lookups
RFC 7208 §4.6.4
1
SPF record per domain
RFC 7208 §3.2
DNS recordOne record, at the root of the domainPublished valuesscrolls →
Name @ (the root — not "spf", not "_spf")
Type TXT
Value v=spf1 include:_spf.google.com include:sendgrid.net ~all
~all softfail — "anything else is suspect"

The normal choice, and what most platforms tell you to publish.

-all hardfail — "anything else is forged"

Correct once you are certain you have listed every sender. Not before.

+all "anybody on earth may send as us"

Occasionally published by accident. It is strictly worse than having no SPF at all.

Each include: costs DNS lookups, and the limit is ten for the whole record. Vendor eleven is where a working setup silently breaks.

Part yours

The platform does part; the rest is genuinely yours.

What goes wrong

Two SPF records on one domain, usually because a second vendor was onboarded by a different team. That is a permanent error under the spec and it fails the check outright — the two records do not combine, they cancel. They must be merged into a single line.

What people get told

The claim. “SPF proves the email is from us.”

Actually. It proves a listed server sent it, and it checks the invisible envelope domain, not the From line your customer reads. A message can pass SPF perfectly while the visible sender is somebody else entirely. Closing that gap is what alignment and DMARC are for.

Not the same as

DKIM
SPF vouches for the server that sent it. DKIM vouches for the message itself. Forwarding breaks SPF and usually survives DKIM.

Check it yourself

Check SPF, the lookup count and +all on any domain

Run it now →

The dated rules behind this

A definition is not a citation. These are the pages with the primary source, the date it was published, and what to do about it.

See also

Where this sits

Stop 3, it leaves your building. Your platform hands the message to a mail server, which stamps it with proof of who sent it.

← BeforeDNSNext →PTR / reverse DNS

FAQ

Awkward questions

Who is this actually for?

People who ship email and are too busy to re-read every PDF: week-one marketers, lifecycle/CRM, deliverability, multi-country ops, DTC brands, agencies — on Klaviyo, Mailchimp, Braze, HubSpot, SFMC, or something else. Pick your tool and geos so product-specific pages only appear when they match. EU and UK are first-class filters. Not for people who sell tools about email and need a fake score to demo.

Why only ~40 rules? Isn’t that… thin?

On purpose. A wall of 400 undated “best practices” is how you look busy and still get burned. Every page needs a primary source we actually read. Thin and checkable beats fat and folklore. Europe, bulk inbox rules, measurement honesty, and protocol topics like BIMI/DMARC policy are on the shelf when we can cite them — not every Member State and not every vendor myth. Coverage map lists what we still refuse to invent.

Is this legal advice?

No. If it were, you’d have a billable hour and a longer PDF. This is a dated operator reference written by an email geek. Confirm anything high-stakes with counsel who knows your facts. Same for “will this make me compliant?” — no tool does that. Lawyers and judges do. We say what the sources say and what to do first on Monday.

Why no trust score out of 100?

Because we refuse to invent a number you can’t audit. Fake scores sell seed tests and panic. You get findings, dates, and links. If that feels less exciting than a red dial, good — you’re not the red-dial customer.

Why should I trust you more than my ESP’s blog?

ESPs sell seats. Seed-score vendors sell fear. AI invents citations when nobody watches. We sell nothing today — no pixels, no placement scores, no affiliate — so we can say when a tool is the problem. A human verifies, dates, and corrects in public. Tools may help draft; they do not ship unsourced claims. Check the primary links. Fail that test and leave.

Do I need an account?

No. Filters live in this browser and the URL. Share the link. That’s it. Accounts come later only if they earn it — not so we can nurture you about email.

I’m an agency. Where’s multi-client mode?

We tried a client-name CRM on the setup card. It made the product feel like work before it felt useful. Role filters + copy link + one-page brief (optional PDF title) is enough for now. Complexity comes back when the free shelf is habit, not before.

Is the quiet changelog a bug?

No. Quiet means nothing material moved. We don’t invent urgency so the homepage looks “alive.” Sticky risks still show what usually needs a person when the market is still.