Beamfar
Sign inStart the 14-day trial

What is SPF (Sender Policy Framework)?

Last updated .

SPF (Sender Policy Framework) lets a domain publish, in a TXT record that starts with v=spf1, the servers and services allowed to send email for it. A receiving server compares the sending address with the list and decides whether the message passes. RFC 7208 defines it.

Definition
SPF
A TXT record that lists which servers may send email for a domain, so receivers can reject forged senders.

Rules that cause trouble

A domain must have a single SPF record; two records give a permanent error. Evaluation is limited to ten DNS-querying mechanisms, and each include: for a newsletter, CRM or helpdesk tool uses some, so adding services can push a record over the limit. The record ends in a qualifier such as ~all (soft fail) or -all (fail) that says what to do with other senders.

Why it matters on a client site

A contact form, a shop and an invoicing system often send email as the client’s domain. Any that is missing from the SPF record may land in spam or be rejected, especially when a strict DMARC policy is in force.

An example

example.com. TXT "v=spf1 mx include:_spf.mailhost.example include:spf.newsletter.example -all": mx allows the domain’s own mail servers, each include: allows one service and -all rejects every other sender. Each include:, a, mx, exists and redirect counts toward the limit of ten DNS lookups, including the lookups inside the included records. Check the count whenever a service is added, and run dig TXT example.com +short to confirm there is one v=spf1 record.

What to check

That there is exactly one SPF record, that it includes every real sending service and that it is merged, not duplicated, when a new service is added.

Sources

Read on . Standards and vendor pages change; confirm the current text before you rely on it.

Guides that use this term

  • DKIMDKIM adds a cryptographic signature to outgoing email, verified with a public key in DNS. Where the key lives and what happens when the selector record is removed.
  • DMARCDMARC is a DNS policy that tells receivers what to do with email that fails SPF and DKIM alignment: nothing, quarantine or reject. Why strict policies amplify DNS mistakes.
  • MX recordAn MX record lists the mail servers for a domain with priorities. What happens to email when it is missing or points to the wrong provider.

Know first. Know why. Tell your client before they call.

Paste your client list. Both regions start checking.

Start the 14-day trialWhat Beamfar watches

No card for the trial.