An SPF record is a line of text in your domain's DNS that says which servers are allowed to send email on behalf of that domain. When a receiving server gets a message claiming to come from you, it looks up your SPF record and checks whether the sending server is on the list. If it is not, the message is more likely to be filtered, quarantined or rejected.
SPF stands for Sender Policy Framework. It is one of three email authentication standards, together with DKIM and DMARC, and it is the one almost every provider checks first.
What an SPF record looks like
SPF lives in a DNS TXT record on the domain you send from. A simple one looks like this:
yourdomain.com. TXT "v=spf1 ip4:203.0.113.25 include:_spf.example.net ~all"Read it from left to right:
v=spf1marks the record as SPF version 1. It must come first.ip4:203.0.113.25allows one IPv4 address. There is alsoip6:for IPv6 and CIDR ranges such asip4:203.0.113.0/24.include:_spf.example.netsays "also trust whatever that domain's own SPF record allows". This is how you authorise an email service you use.~allis the closing rule for everything that did not match. See softfail vs hardfail for the difference between~alland-all.
What SPF actually checks
This surprises many people: SPF does not check the "From" address people see in their email app. It checks the envelope sender, also called the Return-Path or MAIL FROM address, which is set during the SMTP conversation and is usually invisible to the reader. It also checks the HELO name the server announces.
That is why SPF alone cannot stop someone showing your address in the visible From line. DMARC closes that gap by requiring the SPF or DKIM domain to align with the visible From domain.
The mechanisms you will use
| Mechanism | Meaning | Costs a DNS lookup? |
|---|---|---|
ip4: / ip6: | Allow a specific address or range | No |
a | Allow the IP addresses of the domain's A record | Yes |
mx | Allow the domain's mail servers | Yes |
include: | Pull in another domain's SPF policy | Yes |
redirect= | Use another domain's policy entirely | Yes |
all | Matches everything else, with a qualifier | No |
The qualifier in front of a mechanism sets the result: + pass (the default), - fail, ~ softfail, ? neutral.
The five mistakes that break SPF
1. More than one SPF record. A domain must have exactly one TXT record starting with v=spf1. Two records produce a permanent error (permerror) and receivers may ignore both. If you add a new service, merge its include: into your existing record instead of creating a second one.
2. Going over 10 DNS lookups. The standard allows at most ten lookups while evaluating a record, counting include, a, mx, redirect and exists. Go over and the whole record fails. We cover the cure in fixing "too many DNS lookups".
3. Forgetting a sender. Your website, your helpdesk, your invoicing tool and your newsletter service might all send as your domain. Each one must be in the record, or you need to send them from a different subdomain.
4. Typos in the syntax. A missing space between mechanisms, a stray quote, or v=spf instead of v=spf1 all silently invalidate the record.
5. Expecting SPF to survive forwarding. When a message is forwarded, the forwarding server's IP is not in your record, so SPF fails. This is a built-in limit of SPF, and it is one reason DKIM matters: its signature survives forwarding.
How to publish an SPF record
- List every system that sends email using your domain.
- For each, find the SPF
include:value or IP addresses it gives you. - Combine them into one record that starts with
v=spf1and ends with~all(or-allonce you are confident). - Add it as a TXT record at the root (
@) of your domain at your DNS provider. A step-by-step version for Cloudflare is in our DNS guide. - Check it. DNS changes are usually visible within minutes, though cached answers can last for the record's TTL. See how long DNS propagation takes.
You can verify the result with the tools in how to check SPF, DKIM and DMARC for any domain.
How Mailions helps
When you add a domain to Mailions, the panel shows the SPF record to publish alongside the MX, DKIM and DMARC records, and a single click checks them against live public DNS. If you already have an SPF record, the panel's guide explains how to merge rather than duplicate it. Each domain also gets its own DKIM key, so mail is signed as well as authorised.
SPF is necessary but not sufficient. Pair it with DKIM and a DMARC policy, and treat all three as the baseline for any domain that sends email.