What is SPF, and how does a receiver use it?

SPF, Sender Policy Framework, is a TXT record at your domain. It lists the servers allowed to send mail with your domain in the bounce address. A receiving server looks the record up during delivery and compares the connecting server against the list.

Does SPF stop someone forging my From address? Not on its own. SPF checks the bounce address, which the reader never sees. DMARC is what ties the check to the visible From line.

If you're here to publish a record, jump to setting up SPF. If you're here to understand a result, the results table is below.

The check happens during delivery

A sending server connects to the receiver and announces the bounce address, the one that gets the message back if delivery fails. The receiver takes the domain from that address and looks up its TXT records. It finds the one starting with v=spf1.

Then it reads the record left to right, testing each term against the IP address of the server that connected. The first term that matches decides the result. If nothing matches, the ending decides. RFC 7208 defines the order and the qualifiers.

The result goes into the message as a header, usually inside Authentication-Results as spf=pass or another value. Then the receiver moves on to DKIM and DMARC.

The record is one line of text

A domain that sends only through Google Workspace publishes this:

v=spf1 marks the record as SPF. include:_spf.google.com tells the receiver to fetch Google's own record and treat a match there as a match here. ~all says every server not matched so far is probably not authorised.

Each platform you send through adds a term. A server you run yourself gets an ip4: term with its address. Our syntax reference covers each term with valid examples, and the provider pages hold the include for each platform.

The result tells you what matched

RFC 7208 section 2.6 defines each one. Receivers add their own wording beside the result, so quote the whole line when you ask a platform for help.

SPF checks the bounce address, not the From line

Every message carries two sender addresses. The bounce address travels in the SMTP conversation and receives failure notices. The From address sits in the headers and is the one a person reads. They're often different, and SPF only ever looks at the first.

That's why a marketing platform can pass SPF without your domain being involved. It puts its own bounce domain on the message, the receiver checks that domain's record, and the platform's server is in it. SPF passes for the platform. Your domain is in the From line and was never checked.

DMARC closes that gap. It passes only when SPF or DKIM passes for a domain that matches the From domain, a relationship called alignment. Our alignment guide covers the exact and relaxed forms. For SPF to help DMARC, the platform has to use your domain in the bounce address, which most offer as a custom bounce or return-path domain.

Receivers also check the name the sending server announces when it connects, the HELO name. RFC 7208 recommends it and requires the bounce address check if HELO gives no answer. It rarely matters for you unless you run your own mail server.

Where SPF fails on mail you sent

Forwarding. When a recipient forwards your message, their server delivers it and isn't in your record. SPF fails or softfails, and DKIM has to carry DMARC. That's the design, not a bug in your record.

The lookup limit. A receiver stops after 10 DNS lookups, counting every include and the includes inside them. Past 10 the result is permerror, which counts as no record. Our lookup limit guide shows how to count and how to get under it.

Two records. A second v=spf1 record at the same name makes both invalid. Merge them into one. Our multiple records guide covers why.

Subdomains. SPF stops at the exact domain in the bounce address. A record at example.com says nothing about news.example.com. Publish one at each name that appears in a bounce address.

SPF, DKIM and DMARC divide the job

SPF says which servers may send. DKIM signs the message so a receiver can prove it wasn't altered and which domain signed it. DMARC reads both results, checks alignment with the From domain, and applies your policy. Set up SPF and DKIM first, then DMARC, because DMARC has nothing to evaluate without them. Our three-record overview covers the order.

Google's sender guidelines require SPF or DKIM from every sender and both from anyone sending 5,000 messages a day to Gmail. Yahoo asks for both from bulk senders. A domain without SPF fails those requirements before its content is read.

Set up SPF for your domain

1. List every platform that sends as your domain. Staff mail, the helpdesk, the invoice app, the marketing tool, the website's contact form. Ask each team. The one you miss is the one that fails.
2. Take the include from each platform's own documentation. Don't guess one from a forum post. Our provider pages quote the include for each platform and say where it goes.
3. Write one record. Start with v=spf1, add each include, add an ip4: term for any server you run, and end with ~all.
4. Count the lookups before you publish. Our SPF checker resolves each include and shows the total against the limit of 10.
5. Publish it as a TXT record at the exact domain. The host is the domain itself, often written as @ in a DNS panel. Replace any existing SPF record rather than adding beside it.
6. Test with a message from each platform. Send to a mailbox outside your company and read Authentication-Results. Google says it can take up to 48 hours for the record to take effect everywhere.

Tighten ~all to -all once every platform is listed and signs with DKIM for your domain. Our softfail guide covers when that's safe.

Keep the record matching the senders

The record is right on the day you publish it. Then a colleague signs up to a platform, or a platform changes its include, or the marketing tool moves servers. The record drifts from the senders, and the first sign is a failing source in a report.

On a paid plan we email you the first time a source fails DMARC. The weekly digest shows the reported results by source and flags a change to your SPF record. Your first domain is free.