What is SPF?
Also known as: Sender Policy Framework
SPF (Sender Policy Framework) is a DNS-based email authentication method that lets domain owners publish which mail servers are authorized to send email from their domain, helping detect spoofing.
SPF, defined in RFC 7208, is a standard for email authentication that uses DNS TXT records to list the IP addresses authorized to send mail for a given domain. When a receiving mail server gets a message, it can look up the sender domain's SPF record and check whether the source IP of the message matches one of the published IPs. If it does not match, the server can apply a policy such as reject, quarantine, or tag the message as suspicious.
To publish an SPF record, a domain owner creates a TXT record in DNS at the domain level (or a subdomain). The record starts with "v=spf1" followed by mechanisms like "ip4", "ip6", "include" (to include another domain's SPF record), and an all-mechanism (e.g., "-all" for hard fail, "~all" for soft fail). The specification limits the record to 10 DNS lookups per evaluation to prevent denial-of-service attacks against receiving systems. SPF works alongside DKIM and DMARC in the broader email authentication stack. DKIM provides a cryptographic signature for message integrity, while DMARC lets domain owners specify how receivers should handle unauthorized mail and provides reporting. SPF alone does not protect against legitimate senders whose IP changes frequently, nor does it verify message content; it only checks the envelope sender (Return-Path).
Key facts
- Published as a TXT record in the domain's DNS zone, starting with 'v=spf1'.
- Receiving mail servers check the MAIL FROM envelope address against the SPF record.
- RFC 7208 limits SPF evaluations to a maximum of 10 DNS lookups per check.
- An SPF record failure does not automatically reject mail unless DMARC or receiver policy enforces it.
- SPF does not validate message headers or body content, only the sending IP address.
How it works in practice
Related terms
References
More in Email
BIMI
BIMI (Brand Indicators for Message Identification) is a DMARC-aligned standard that lets email senders publish a verified logo for display in supporting mail clients.
Bounce Message
A bounce message, or non-delivery report (NDR), is an automated email sent to the originator when delivery cannot be completed, including a status code and failure reason.
Catch-All Email
A catch-all email account receives all messages sent to invalid or nonexistent addresses at a domain, preventing bounce-backs but attracting spam.
DKIM
DKIM is an email authentication method that lets a domain claim responsibility for a message by attaching a cryptographic signature validated against a DNS public key.
DMARC
DMARC is an email authentication policy protocol that builds on SPF and DKIM to tell receiving mail servers how to handle messages that fail authentication checks.
DNSBL
A DNSBL is a real-time IP reputation database published via DNS, used by mail servers at SMTP time to reject or flag senders known for spam or abuse.
Greylisting
Greylisting is a spam-filtering technique that temporarily rejects email from unknown senders, forcing legitimate mail servers to retry delivery while filtering out spammers that do not retry.
IMAP
IMAP is an email protocol that lets clients access and manage messages stored on a mail server, keeping the server as the authoritative copy and synchronizing folder state across multiple devices.
Mailbox Quota
A mailbox quota is a storage limit placed on a user's email account. Once the total size of stored messages exceeds this limit, the server may reject new incoming emails or warn the user.
MDA
An MDA (Mail Delivery Agent) is a software component that transfers an email from a Mail Transfer Agent (MTA) into a recipient's local mailbox, typically on a mail server or a user's machine.