What Is an SPF Record?
How an SPF Record Works
An SPF record is a DNS TXT record that lists which mail servers may send email for a domain. Sender Policy Framework, or SPF, is the standard that defines the record format and the checks. When a receiving server gets a message, it looks up the SPF record of the domain in the envelope sender and checks whether the connecting server's IP address is on the list.
A simple record looks like this: v=spf1 ip4:192.0.2.10 include:_spf.example.net ~all. The version tag comes first. The ip4 mechanism lists an address directly, while include points to another domain's SPF record, which mail providers often publish to cover their own servers. The last mechanism says what to do with every server not named above.
Qualifiers and the Ten-Lookup Limit
Each mechanism can carry a qualifier. A plus sign means pass, a hyphen means fail, a tilde means soft fail and a question mark means neutral. A record ending in -all tells receivers to treat any unlisted server as unauthorized. A record ending in ~all says unlisted servers are suspicious but leaves the decision to the receiver, which many domains use while they set things up.
SPF evaluation is limited to ten DNS lookups. Mechanisms such as include, a and mx each need a lookup, and includes can nest inside other includes. Going over ten causes a permanent error, and the check fails. Long chains of included providers are a common cause, so keep records short and remove services that no longer send mail for the domain.
The Limits of SPF
SPF checks the domain in the envelope sender, not the name a reader sees in the From header. A spammer can therefore send a message that displays a bank's name while passing SPF for a domain the spammer controls. This gap is why SPF is usually combined with DKIM and DMARC.
SPF also breaks when mail is forwarded, because the forwarder is not on the original domain's list. The effect and its usual fix are explained in email forwarding.
Frequently asked questions
Do I need an SPF record for my domain?
If your domain sends email, or its name could be used by others to send mail, an SPF record is strongly recommended. Without one, receivers cannot tell which servers are yours, which weakens protection against spoofing. A domain that never sends mail can publish a record that rejects every sender, a common practice for that case.
What does ~all mean in an SPF record?
The ~all mechanism means soft fail. It tells receiving servers that mail from any server not listed is probably unauthorized, but the decision is left to them. Many receivers accept or mark such mail rather than rejecting it. A stricter -all asks receivers to reject unlisted senders outright.