What Is SPF in Email? (Sender Policy Framework Explained)

SPF in 30 Seconds

SPF tells the world which servers are allowed to send email for your domain. It's a DNS TXT record — nothing installed on your mail server, just a line of text in your DNS.

When Gmail receives an email from your domain, it looks up your SPF record, checks if the sending server's IP is listed, and marks SPF as pass or fail.

How SPF Works

1. You publish a TXT record at example.com in DNS
2. Someone sends email using your domain
3. The receiving server extracts the sending IP from the SMTP connection
4. It queries DNS for example.com's SPF record
5. It checks if the sending IP matches any authorized source
6. Result: pass, fail, softfail, neutral, or none

SPF Record Syntax

v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.0/24 -all

• v=spf1 — required version tag
• include: — authorizes another domain's SPF record (adds its IPs)
• ip4: / ip6: — authorizes specific IP addresses
• -all — hard fail everything not listed (recommended)
• ~all — soft fail (used during testing)

The 10 Lookup Limit

SPF allows a maximum of 10 DNS mechanisms that require lookups (include, a, mx, redirect). Each include counts as one lookup plus any lookups that included record makes. Exceeding 10 causes a permerror, which breaks SPF entirely.

If you have multiple ESPs, you'll hit this fast. Solutions include SPF flattening and consolidating senders.

SPF Limitations

SPF checks the envelope sender (Return-Path), not the From: header the recipient sees. This means SPF alone doesn't prevent display-name spoofing. That's why DMARC exists — it ties SPF (and DKIM) results to the visible From: domain.

SPF also breaks with email forwarding because the forwarding server's IP isn't in the original domain's SPF record. ARC was created to solve this.

Practitioner note: The most common SPF mistake I see is ~all (softfail) in production. It was meant for testing. Switch to -all once you've confirmed all legitimate senders are included.

Practitioner note: Every time a client adds a new SaaS tool that sends email (helpdesk, invoicing, marketing), they need to update SPF. Most don't, and authentication silently fails for that tool's emails.

For the complete setup process, read the SPF setup guide. If your SPF is failing, start with the SPF troubleshooting guide.

Need help configuring SPF across multiple senders? Schedule a consultation — I'll audit your SPF record and fix lookup limit issues.

Sources

• RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email
• Google: SPF record requirements for Gmail
• Microsoft: Set up SPF to help prevent spoofing
• Dmarcian: SPF Overview

---

v1.0 · April 2026