What is SPF in email?

SPF (Sender Policy Framework) is an email authentication standard that lets a domain owner list which mail servers may send email for their domain. The list is published in DNS as a TXT record. When a message arrives, the receiving server checks whether the server that sent it is on that list.

What is the difference between SPF and DKIM?

SPF checks that the sending server is allowed to send for your domain, by comparing its IP address with your DNS record. DKIM adds a cryptographic signature to the message, which proves the content was not changed in transit. SPF checks who sent it; DKIM checks what was sent. Use both: DMARC needs at least one of them to pass and align with your domain.

How do I create an SPF record?

Add a TXT record at the root of your domain (@) in the form v=spf1 include:your-provider ~all, using the include value your email provider gives you. If you send through more than one service, list them all in the same record, for example v=spf1 include:_spf.google.com include:spf.useplunk.com ~all. A domain can only have one SPF record.

What does ~all mean in an SPF record?

~all is a soft fail: mail from servers that are not listed should be accepted but treated as suspicious. -all is a hard fail and asks receivers to reject that mail outright. Start with ~all while you confirm every sender is listed, then move to -all if you want. Never use +all, which lets any server pass.

Why is SPF failing even though I set it up correctly?

The usual causes are: two SPF records on the same domain (merge them into one); more than 10 DNS lookups (each include counts); a new sending service that was never added; DNS changes that have not propagated yet, which can take up to 48 hours; or forwarding, which changes the sending server and breaks SPF. Set up DKIM as well so forwarded mail still authenticates.

What is SPF? Email Sender Policy Framework Explained

How SPF works

Anyone can put your domain in the From line of an email. SPF is how a receiving server tells real mail from forged mail: it compares the server that delivered the message with the list you published.

You publish a record
A TXT record on your domain lists every service and IP address allowed to send for it.
A message arrives
The receiving server notes the IP address of the server that delivered it.
It looks up your record
It fetches the SPF record for the domain in the message’s return path.
Pass or fail
If the IP is on the list, SPF passes. If not, it fails, and the message may be filtered or rejected.

Your receipt from Acme

From billing@acme.com

Sent by: Plunk
SPF: Pass

Urgent: verify your account

From billing@acme.com

Sent by: Unknown server
SPF: Fail

Same From address, two servers. Only the listed one passes.

Reading an SPF record

An SPF record is one line of text. It starts with the version, lists the allowed senders, and ends with what to do about everyone else.

TXT record on acme.com

v=spf1 include:_spf.google.com include:sendgrid.net ip4:192.0.2.1 ~all

Part	What it means
v=spf1	The SPF version. Every record starts with this.
include:sendgrid.net	Allow every server listed in another domain’s SPF record. This is how you add a provider.
ip4:192.0.2.1	Allow one IPv4 address, or a range such as 192.0.2.0/24.
ip6:2001:db8::1	Allow one IPv6 address or range.
a	Allow the IP addresses in the domain’s A record.
mx	Allow the servers in the domain’s MX records.
~all	Soft fail: accept mail from anyone else, but mark it as suspicious.
-all	Hard fail: reject mail from anyone else.

Why SPF matters

Stops spoofing
Forged mail from servers you did not list fails the check.
Helps you reach the inbox
Gmail, Yahoo and Outlook expect bulk senders to pass SPF.
Protects your domain
Phishing that uses your name is easier for inboxes to catch.
Needed for DMARC
DMARC builds on SPF and DKIM results.

How to set up SPF

List everything that sends as you
Your mailbox provider, your product’s email service, your help desk, your newsletter tool.
Collect each service’s include
Every provider documents the value to add.
Value Service
include:_spf.google.com Google Workspace
include:spf.protection.outlook.com Microsoft 365
include:spf.useplunk.com Plunk

Value	Service
include:_spf.google.com	Google Workspace
include:spf.protection.outlook.com	Microsoft 365
include:spf.useplunk.com	Plunk

Combine them into one record

v=spf1 include:_spf.google.com include:spf.useplunk.com ~all

Add it to your DNS
Create a TXT record at the root of your domain, usually written as @. Replace any SPF record that is already there rather than adding a second one.
Check it
Run your domain through the SPF checker to confirm the record is valid and under the lookup limit.

Common mistakes

Two SPF records
A domain can only have one. With two, both are ignored and SPF fails. Merge them.
Too many lookups
Each include adds at least one lookup. Past 10, every message fails.
Forgetting a new tool
When you start sending from a new service, add it to the record the same day.
Ending with +all
+all lets any server in the world pass. Use ~all or -all.

What is SPF?