SPF
A public DNS list of servers allowed to send mail for your domain.
Say it out loud
“A public list of the servers allowed to send as us. Anything else looks like a forgery.”
SPF (Sender Policy Framework) is a DNS record naming which mail servers may send email for your domain. Receivers check the sending server's address against it. Your platform tells you what to add; publishing it is yours, and there can only ever be one SPF record on a domain.
- 10
- maximum DNS lookups
- RFC 7208 §4.6.4
- 1
- SPF record per domain
- RFC 7208 §3.2
The normal choice, and what most platforms tell you to publish.
Correct once you are certain you have listed every sender. Not before.
Occasionally published by accident. It is strictly worse than having no SPF at all.
Each include: costs DNS lookups, and the limit is ten for the whole record. Vendor eleven is where a working setup silently breaks.
Part yours
The platform does part; the rest is genuinely yours.
What goes wrong
Two SPF records on one domain, usually because a second vendor was onboarded by a different team. That is a permanent error under the spec and it fails the check outright — the two records do not combine, they cancel. They must be merged into a single line.
What people get told
The claim. “SPF proves the email is from us.”
Actually. It proves a listed server sent it, and it checks the invisible envelope domain, not the From line your customer reads. A message can pass SPF perfectly while the visible sender is somebody else entirely. Closing that gap is what alignment and DMARC are for.
Not the same as
- DKIM
- SPF vouches for the server that sent it. DKIM vouches for the message itself. Forwarding breaks SPF and usually survives DKIM.
Check it yourself
Check SPF, the lookup count and +all on any domain
Run it now →The dated rules behind this
A definition is not a citation. These are the pages with the primary source, the date it was published, and what to do about it.
See also
Where this sits
Stop 3, it leaves your building. Your platform hands the message to a mail server, which stamps it with proof of who sent it.