SPF (Sender Policy Framework)

SPF is a DNS TXT record that lists which mail servers are allowed to send email for your domain. Receiving servers check the connecting server's IP address against that list.

What it looks like

A typical SPF record: v=spf1 include:_spf.google.com ~all

include: mechanisms pull in another provider's list of sending IPs (useful when you send through Google Workspace, Microsoft 365, or a CRM/marketing platform). The final mechanism — ~all (soft fail) or -all (hard fail) — tells receivers what to do about anything not covered by the list above it.

What it doesn't protect against

• SPF only checks the technical "envelope sender," not the visible "From" address a person reads — so SPF alone doesn't stop every kind of display-name spoofing.
• SPF breaks when mail is forwarded, because the forwarding server isn't in your SPF list.
• SPF has a 10 DNS-lookup limit. Records that chain too many include:s silently stop working past that limit — this is one of the most common real-world SPF failures.

SPF is one of three pieces. DMARC is what actually determines whether a receiver rejects, quarantines or delivers a message that fails SPF.

Checking your SPF record

Run dig txt yourdomain.com (or nslookup -type=txt yourdomain.com on Windows) and look for the line starting v=spf1 — or just run a free check here, which also flags a missing -all/~all, too many DNS lookups, and multiple SPF records (a domain can only have one).

Setting one up

Generate a starting SPF record from the services that send mail for your domain, or follow a provider guide: Microsoft 365 · Google Workspace.