Skip to content

Glossary · Sender Policy Framework

What is SPF?

Quick answer

SPF (Sender Policy Framework) lets a domain publish, in a single DNS TXT record, which servers may send mail that uses the domain in the envelope sender. Receivers compare the connecting IP with that record and get a result such as pass, fail or softfail. SPF does not protect the From address people see; it only counts for DMARC when the envelope domain aligns with From.

Definition

SPF (Sender Policy Framework): A TXT record (RFC 7208) listing the servers allowed to send mail for a domain. Receivers check the connecting IP against the record for the envelope sender domain; evaluation may use at most 10 DNS lookups, and exceeding that is a permerror.

How SPF works

The receiving server takes the domain from the envelope sender (MAIL FROM, which later shows up as Return-Path) and looks up its TXT record starting with v=spf1. It walks the mechanisms left to right: ip4 and ip6 for address ranges, include for other domains' records, a and mx for the domain's own hosts.

The first mechanism that matches decides the result. The all mechanism at the end catches everything else: -all means fail, ~all means softfail. A record with a syntax error, or two separate v=spf1 records on one domain, returns permerror.

The SPF 10 DNS lookup limit

RFC 7208 caps evaluation at 10 DNS lookups. Every include, a, mx, ptr, exists and redirect counts, including the ones nested inside included records. The ip4, ip6 and all mechanisms do not.

Go over 10 and the result is permerror, which DMARC treats as a failure. Each new email tool you add usually brings its own include, so the limit is easy to hit. Fixes are removing services you no longer use, replacing includes with ip4 ranges you control, or moving a sender to a subdomain with its own record.

Why SPF breaks on forwarding

When a message is forwarded, the forwarding server connects with its own IP, which is not in your SPF record. SPF fails even though you did nothing wrong.

DKIM signatures usually survive forwarding, which is why DMARC accepts a pass from either SPF or DKIM. Set up both.

example.com.  3600  IN  TXT  "v=spf1 ip4:192.0.2.0/24 include:_spf.google.com include:sendgrid.net -all"
Allows one IP range, Google Workspace and SendGrid, and fails everything else. Each include counts as one lookup, plus any lookups inside it.

How RocketVerifier handles it

Our free SPF checker looks up and validates your record, counts its DNS lookups against the limit of 10 and expands every include, and the SPF record generator combines your senders into one record with a live lookup count. The email deliverability checker scores SPF, DKIM and DMARC for a domain in one pass. Monitors recheck SPF, DKIM, DMARC and blocklist status on a schedule and alert you when something breaks.

Go further

Sources

  1. RFC 7208: Sender Policy Framework (SPF)
  2. Google: Email sender guidelines

FAQ

SPF: common questions

Should I use -all or ~all?

Use ~all while you are still finding every service that sends for you, then move to -all once the record is complete. Under DMARC both count as a non-pass, so the policy in your DMARC record matters more than the qualifier.

Do I need SPF on a domain that never sends email?

Yes. Publish v=spf1 -all so receivers reject anyone sending as that domain, and pair it with a DMARC policy of p=reject. Parked domains are a favorite target for spoofing because nobody watches them.

Does SPF check the From address in my email client?

No. SPF checks the envelope sender, which can be a different domain from the visible From address, for example an ESP bounce domain. DMARC alignment is what connects the two.

Turn definitions into a cleaner list

Verify your first emails in minutes. Credits never expire, and unknown results are always free.

Start free Browse the glossary

100 free credits · No card required · Credits never expire