What Is an SPF Record? Sender Policy Framework Explained

SPF is the oldest and simplest email authentication standard, introduced in 2003. Despite its age — and its limitations — it’s a required foundation for email deliverability and spoofing protection. If your domain sends email and has no SPF record, fix that before everything else.

What SPF Does

SPF lets you publish a list of authorized mail servers in DNS. When a receiving mail server gets email claiming to be from @yourdomain.com, it:

1. Extracts the envelope sender domain from the MAIL FROM command
2. Looks up the SPF TXT record at that domain
3. Checks whether the sending IP matches any entry in the record
4. Returns Pass, Fail, SoftFail, Neutral, or PermError

Email arrives from IP 74.125.130.27 claiming MAIL FROM: <anything@example.com>
        ↓
DNS lookup: example.com TXT → "v=spf1 include:_spf.google.com ~all"
        ↓
Expand include:_spf.google.com → contains 74.125.130.27
        ↓
Result: SPF Pass ✓

SPF Record Syntax

An SPF record is a TXT record published at your root domain. It always starts with v=spf1:

example.com.  TXT  "v=spf1 ip4:203.0.113.0/24 include:_spf.google.com include:sendgrid.net ~all"

Mechanisms

Qualifiers

Every mechanism can be prefixed with a qualifier:

All Qualifier: What to Use

; Strict: reject emails from unlisted IPs
"v=spf1 include:_spf.google.com -all"

; Soft: flag but deliver (recommended while setting up)
"v=spf1 include:_spf.google.com ~all"

; No policy (useless for security)
"v=spf1 include:_spf.google.com ?all"

Start with ~all while you’re confirming all sending sources are included. Switch to -all once you’re confident. With DMARC p=reject, the distinction matters less.

Common Sending Sources to Include

Only include the services that actually send email for your domain. Every include: costs one DNS lookup.

The 10-Lookup Limit

RFC 7208 limits SPF evaluation to 10 DNS lookups. Each include:, a:, mx:, or ptr: mechanism triggers a lookup (and the lookups they trigger count too).

; This record might look fine but could exceed 10 lookups:
"v=spf1 include:_spf.google.com include:spf.protection.outlook.com 
        include:sendgrid.net include:mailgun.org include:_spf.hubspot.com
        include:servers.mcsv.net include:amazonses.com ~all"

If you hit the limit, receiving servers return PermError — treated like a misconfiguration.

Fix: Replace include: with explicit ip4:/ip6: ranges. Look up what IPs each service’s SPF include expands to and add them directly. This is called SPF flattening. Some tools do this automatically and keep the flattened record updated.

Writing Your First SPF Record

Step 1: Identify all services that send email using your domain:

• Your main email provider (Google Workspace, M365)
• Your marketing platform (Mailchimp, HubSpot)
• Your transactional email provider (SendGrid, Postmark)
• Any custom applications or servers

Step 2: Build the record:

; Simple: only Google Workspace
example.com.  TXT  "v=spf1 include:_spf.google.com ~all"

; Multiple services + dedicated server IP
example.com.  TXT  "v=spf1 ip4:203.0.113.42 include:_spf.google.com include:sendgrid.net ~all"

Step 3: Publish as a TXT record at your root domain (@ or example.com). TTL of 300-3600 seconds.

Step 4: Verify:

dig TXT example.com | grep spf
# or
nslookup -type=TXT example.com

Verifying SPF Pass in Email Headers

When you send a test email to Gmail and view the original headers, look for:

Received-SPF: pass (google.com: domain of sender@example.com designates 
              74.125.130.27 as permitted sender) client-ip=74.125.130.27;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of sender@example.com designates 
                 74.125.130.27 as permitted sender) smtp.mailfrom=sender@example.com;

spf=pass confirms your record is working.

SPF for Subdomains

SPF does not apply recursively to subdomains. If you send email from marketing.example.com, that subdomain needs its own SPF record:

marketing.example.com.  TXT  "v=spf1 include:servers.mcsv.net ~all"

Domains that never send email should have a restrictive SPF record to prevent misuse:

noreply.example.com.  TXT  "v=spf1 -all"

SPF Limitations: Why It’s Not Enough Alone

SPF has two fundamental limitations:

1. It checks the envelope sender, not the From: header. The address users actually see (From:) can be anything. SPF passes on the invisible envelope address.

2. Email forwarding breaks SPF. When a server forwards email, it changes the envelope sender. The new sending IP isn’t in the original domain’s SPF, so SPF fails — even for legitimate mail.

Both limitations are why DKIM and DMARC exist. DKIM signs the message cryptographically (survives forwarding). DMARC ties both mechanisms to the From: header and specifies what to do when they fail.

Use all three: SPF + DKIM + DMARC.

Quick Reference

; Full example
example.com.  TXT  "v=spf1 ip4:203.0.113.0/24 include:_spf.google.com include:sendgrid.net -all"

; Subdomain that sends no email
static.example.com.  TXT  "v=spf1 -all"

; Check current record
dig TXT example.com +short

; Test SPF evaluation for a specific IP
python3 -c "import spf; print(spf.check2('203.0.113.42', 'user@example.com', 'example.com'))"

SPF is the 10-minute fix that blocks a significant class of spoofing. Set it up, verify it, then layer DKIM and DMARC on top.