====== SPF — Sender Policy Framework ======

SPF (Sender Policy Framework) is an email authentication method that prevents spammers from sending emails using your domain.

-----

===== What is SPF? =====

SPF allows domain owners to specify which mail servers are authorized to send emails on their behalf.

When a receiving mail server gets an email, it checks:

  1. The envelope sender domain (Return-Path)
  2. The IP address of the sending server
  3. The SPF record published by the domain owner
  4. If the IP is authorized, SPF passes; otherwise, it fails

-----

===== SPF Record Format =====

An SPF record is a TXT record published in the domain's DNS:

example.com. TXT "v=spf1 include:_spf.google.com ~all"


**Components:**

^ Component ^ Description ^
| **v=spf1** | Version (must be exactly this) |
| **Mechanisms** | Who is allowed to send |
| **Qualifier** | What to do with unauthorized senders |

-----

===== SPF Mechanisms =====

^ Mechanism ^ Meaning ^
| `a` | The domain's A record IP address |
| `mx` | The domain's MX record IP addresses |
| `include` | Include SPF records from another domain |
| `ip4` | A specific IPv4 address |
| `ip6` | A specific IPv6 address |
| `ptr` | PTR record (reverse lookup) |
| `exists` | Check if a domain exists |
| `all` | Everything else (catch-all) |

-----

===== SPF Qualifiers =====

^ Qualifier ^ Meaning ^
| **+** | Pass — authorized (default) |
| **-** | Fail — hard fail (reject) |
| **~** | Soft Fail — mark as spam |
| **?** | Neutral — no policy |

-----

===== Common SPF Examples =====

**Google Workspace (Gmail):**

v=spf1 include:_spf.google.com ~all

**Microsoft 365:**

v=spf1 include:spf.protection.outlook.com ~all

**Custom (self-hosted):**

v=spf1 a mx ip4:192.168.1.0/24 ~all

-----

===== SPF Lookup Limits =====

SPF has a hard limit of **10 DNS lookups**. If you exceed this, receivers may reject your email.

**Lookup mechanisms:**
  * include
  * a
  * mx
  * ptr
  * exists
  * redirect

-----

===== SPF Policy Levels =====

^ Level ^ Policy ^ Description ^
| **Strong** | `-all` | Hard fail — unlisted senders are rejected |
| **Moderate** | `~all` | Soft fail — unlisted senders go to spam |
| **Weak** | `?all` | Neutral — no policy applied |
| **Dangerous** | `+all` | Pass all — effectively no protection |

-----

===== Test Your SPF =====

Use our [[https://telenegar.ir/mailcheck/|Mail Check tool]] to verify your SPF, DKIM, and DMARC records.

-----

{{tag>email spf authentication}}