What is a spf?
Also called: Sender Policy Framework
SPF, or Sender Policy Framework, is a DNS TXT record listing which mail servers are allowed to send email for a domain. A receiving server compares the sending server's IP against that list and treats a mismatch as a signal of forgery. It is one of the three records that make up modern email authentication.
An SPF record looks like v=spf1 include:_spf.google.com ip4:203.0.113.5 ~all. The mechanisms name authorised senders, and the final qualifier says what to do with everything else: ~all is a soft fail, -all a hard fail, and +all authorises the entire internet and should never be used.
The most common SPF mistake is exceeding the ten-DNS-lookup limit by chaining too many include: mechanisms — each one costs a lookup, and going over the limit makes the whole record fail rather than simply ignoring the extras.
SPF alone is weak, because it validates the envelope sender rather than the From address a human sees. It only becomes meaningful when DMARC ties the two together.
Last reviewed 2026-09-11