SPF (Sender Policy Framework) is an email authentication method defined in RFC 7208 that lets domain owners publish a list of authorized mail servers via a DNS TXT record. Receiving mail servers query this record to verify that the sending server's IP address is permitted to send email from that domain.
How SPF works
When a mail server receives an email, it extracts the envelope sender domain (the SMTP MAIL FROM address) and queries DNS for that domain's SPF record. The server then evaluates the mechanisms in the record (such as ip4, include, mx, or a) from left to right. Each mechanism includes a qualifier (+ for pass, - for fail, ~ for softfail) that determines the result. The final all mechanism sets the default policy for any IP not explicitly listed.
Example SPF record
v=spf1 ip4:192.0.2.0/24 include:_spf.google.com -all
This authorizes the 192.0.2.0/24 range and any servers published in Google's SPF include, and rejects (-all) all others.
SPF only authenticates the envelope sender domain — it does not authenticate the visible "From:" header shown to users. For complete email security, pair SPF with DKIM and DMARC.
WarningSPF has a 10 DNS lookup limit per RFC 7208. Exceeding this (commonly by chaining too many
include:statements) causes a PermError, which most receivers treat as a failure. Monitor your lookup count when using multiple third-party mail services.
Use the SPF generator tool to build and validate your SPF record.