Definition
SPF lets a domain publish which systems may send mail using that domain as the SMTP MAIL FROM or HELO identity. The receiver looks up the applicable TXT record and compares the connecting IP with its mechanisms.
SPF does not directly authenticate the visible From header. DMARC connects SPF to that visible identity only when the SPF-authenticated domain aligns with the From domain.
Why it matters
SPF gives receivers a machine-readable authorization signal and contributes to DMARC. It is particularly useful for direct delivery, although forwarding often breaks SPF because the forwarding server’s IP is not in the original domain’s policy.
How it works
- 01
The sender declares an envelope MAIL FROM domain.
- 02
The receiver queries that domain’s SPF TXT record.
- 03
Mechanisms such as ip4, ip6, include, a, and mx are evaluated in order.
- 04
The receiver returns an SPF result such as pass, fail, softfail, neutral, or temperror.
Example
example.com. TXT "v=spf1 include:spf.sender.example ip4:192.0.2.10 -all"
v=spf1 SPF version
include:... authorize a provider
ip4:192.0.2.10 authorize one IPv4 address
-all all other sources failCommon mistakes
- Publishing multiple SPF records for the same domain.
- Exceeding the ten DNS-lookup limit during evaluation.
- Authorizing unused vendors indefinitely.
- Expecting SPF alone to survive forwarding or protect the visible From address.
Key takeaways
- SPF authenticates an envelope identity, not the visible From by itself.
- Keep one record, minimize lookups, and audit includes.
- Use aligned DKIM as a resilient companion.