Fundamentals · SPF

What is SPF?

The Sender Policy Framework is the digital bouncer of your domain — it decides which servers are allowed to send email on your behalf.

The problem

In the default email protocol, any server can claim to send mail for your-company.com. Without additional information, recipients have no way to verify whether the sender address is genuine. This is the basis of phishing and CEO fraud.

How SPF works

SPF solves the problem with a DNS record. In a TXT record, you publish a list of servers that are allowed to send for your domain. The receiving mail server queries this list and compares it against the IP address that the email is currently coming from.

Sender mail.firma.at IP 192.0.2.10 Recipient server checks SPF DNS TXT record 1. Email 2. queries 3. list 4. IP in list? → mail OK. Otherwise → reject.
SPF check in 4 steps

Example record

This is what a typical SPF entry in DNS looks like — here for a domain that uses Google Workspace and Mailgun:

; TXT record for @ (root domain)
"v=spf1 include:_spf.google.com include:mailgun.org ~all"

The key components:

The four policy endings

EndingMeaningRecommendation
-allHardfail — anything outside the list is rejected.Ideal
~allSoftfail — suspicious, but not blocked.Good
?allNeutral — no statement.Weak
+allEverything allowed.Never
Important: SPF alone does not fully protect you. An attacker can forge the visible From address without SPF noticing. Only the combination with DKIM and DMARC closes this gap.

The most common pitfalls

Frequently asked questions

What is the DNS lookup limit?

SPF allows a maximum of 10 DNS lookups per evaluation. Every include:, a:, mx:, exists: and ptr: counts. If the limit is exceeded, the checking server responds with PermError and SPF is treated as failed.

What is the difference between -all and ~all?

-all (hardfail) instructs mail servers to reject non-matching mail. ~all (softfail) lets it through but marks it as suspicious. For production domains with active DMARC, -all is the right choice.

Can I have multiple SPF records on one domain?

No. Multiple TXT records with v=spf1 on the same host result in PermError. Consolidate all mechanisms into a single record.

Do I still need SPF if I use DMARC?

Yes. DMARC builds on SPF and/or DKIM. Without at least one of the two passing plus aligned, DMARC fails — even if the other components are correct.

How do I test SPF changes without risk?

First set a low TTL (300 seconds), check with the Mailantis SelfCheck and watch DMARC aggregate reports for a few days. Only then raise the TTL again.