What Is SPF? Sender Policy Framework Explained

What SPF actually does

Sender Policy Framework publishes authorization information in DNS. When a receiving mail system evaluates SPF, it checks whether the connecting sending IP is permitted by the domain used for the SMTP envelope sender.

SPF does not by itself prove that the visible From address seen by a recipient is legitimate. DMARC adds alignment requirements that connect SPF or DKIM authentication to the visible From domain.

• SPF information is normally published in a DNS TXT record.
• An SPF record begins with v=spf1.
• Mechanisms such as ip4, ip6, a, mx and include can authorize senders.
• The final all mechanism describes how unmatched senders should be treated.

Common SPF mechanisms

The ip4 and ip6 mechanisms authorize explicit address ranges. The a and mx mechanisms depend on additional DNS lookups. include delegates authorization to another domain's SPF policy, which is common with hosted email and marketing providers.

redirect is a modifier that points SPF evaluation toward another policy. Complex include and redirect chains matter because SPF imposes a DNS lookup limit during evaluation.

• ip4 and ip6 authorize address ranges directly.
• a authorizes addresses resolved from a hostname.
• mx authorizes addresses belonging to mail exchangers.
• include evaluates another SPF policy.
• redirect transfers evaluation to another domain's SPF record.

SPF softfail and hardfail

A record often ends in ~all or -all. A softfail communicates that unmatched senders are probably unauthorized, while a hardfail is a stronger declaration that they are unauthorized.

The correct policy depends on whether all legitimate sending systems have been identified. Tightening an SPF policy before inventorying senders can cause authentication failures for legitimate mail.

How to check an SPF record

Start by finding the domain's SPF TXT record. Validate syntax, identify each DNS-dependent mechanism, inspect include and redirect chains and count the DNS lookups required during evaluation.

A checker should distinguish between a malformed record, an absent record and evidence that simply cannot be resolved at the moment of the test.