SPF (Sender Policy Framework)

SPF allows you to specify which mail servers are authorized to send email on behalf of your domain. Receiving servers check SPF to verify the sending server is legitimate.

How SPF Works

1. You publish an SPF record in your domain's DNS (TXT record)
2. The record lists authorized sending IP addresses and domains
3. When a server receives email from your domain, it looks up your SPF record
4. It checks if the sending server's IP is authorized
5. The result (pass/fail/softfail) influences delivery decisions

SPF Record Syntax

# Basic SPF record structure
v=spf1 [mechanisms] [modifiers] [qualifier]all

# Example: Allow Google Workspace and a custom server
v=spf1 include:_spf.google.com ip4:203.0.113.50 -all

# Breakdown:
# v=spf1         - Version (required, must be first)
# include:       - Include another domain's SPF record
# ip4:           - Authorize specific IPv4 address/range
# ip6:           - Authorize specific IPv6 address/range
# a              - Authorize the domain's A record IPs
# mx             - Authorize the domain's MX record IPs
# -all           - Fail all other sources (strict)
# ~all           - Softfail all other sources (testing)
# ?all           - Neutral (not recommended)

SPF Qualifiers

Common SPF Includes

Here are the SPF include statements for popular email services:

Avoiding the Lookup Limit

If you're hitting the 10 lookup limit, consider these solutions:

• Flatten your SPF record — Replace includes with explicit IP addresses
• Use SPF flattening services — Tools that automatically maintain flattened records
• Remove unused services — Audit and remove services you no longer use
• Use subdomains — Send from different subdomains for different services

SPF Limitations

SPF alone isn't enough for full email authentication:

• Only checks envelope sender — Not the "From" header that users see
• Breaks with forwarding — Forwarded emails fail SPF because the forwarding server isn't authorized
• No encryption — SPF doesn't protect message content

That's why SPF should always be used together with DKIM and DMARC.

Example SPF Records

v=spf1 include:_spf.google.com -all

v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.50 -all

v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net include:spf.hubspot.com -all

Next Steps

• Step-by-step: How to Set Up SPF
• Learn about DKIM
• Learn about DMARC
• Test your SPF record