SPF (Sender Policy Framework) is an email authentication method that prevents spammers from sending emails using your domain.
SPF allows domain owners to specify which mail servers are authorized to send emails on their behalf.
When a receiving mail server gets an email, it checks:
1. The envelope sender domain (Return-Path) 2. The IP address of the sending server 3. The SPF record published by the domain owner 4. If the IP is authorized, SPF passes; otherwise, it fails
An SPF record is a TXT record published in the domain's DNS:
example.com. TXT “v=spf1 include:_spf.google.com ~all”
Components:
| Component | Description |
|---|---|
| v=spf1 | Version (must be exactly this) |
| Mechanisms | Who is allowed to send |
| Qualifier | What to do with unauthorized senders |
| Mechanism | Meaning |
|---|---|
| `a` | The domain's A record IP address |
| `mx` | The domain's MX record IP addresses |
| `include` | Include SPF records from another domain |
| `ip4` | A specific IPv4 address |
| `ip6` | A specific IPv6 address |
| `ptr` | PTR record (reverse lookup) |
| `exists` | Check if a domain exists |
| `all` | Everything else (catch-all) |
| Qualifier | Meaning |
|---|---|
| + | Pass — authorized (default) |
| - | Fail — hard fail (reject) |
| ~ | Soft Fail — mark as spam |
| ? | Neutral — no policy |
Google Workspace (Gmail):
v=spf1 include:_spf.google.com ~all
Microsoft 365:
v=spf1 include:spf.protection.outlook.com ~all
Custom (self-hosted):
v=spf1 a mx ip4:192.168.1.0/24 ~all
SPF has a hard limit of 10 DNS lookups. If you exceed this, receivers may reject your email.
Lookup mechanisms:
| Level | Policy | Description |
|---|---|---|
| Strong | `-all` | Hard fail — unlisted senders are rejected |
| Moderate | `~all` | Soft fail — unlisted senders go to spam |
| Weak | `?all` | Neutral — no policy applied |
| Dangerous | `+all` | Pass all — effectively no protection |