How SPF Records Work and How to Build One Safely

SPF, or Sender Policy Framework, is an email-authentication mechanism published in DNS. It gives receiving mail systems a policy for checking whether a server is authorized to send mail using a domain in the SMTP envelope.

Start with one inventory of senders

Before writing the record, list every service that sends mail for the domain: your normal mailbox provider, website forms, CRM, newsletter platform, help desk, invoicing system, application servers, and any legacy service that still sends mail.

The record begins with v=spf1

That version marker tells a receiver that the TXT value is an SPF policy. Common mechanisms that follow include:

• ip4: and ip6: for explicit sending addresses.
• include: for a provider’s published SPF policy.
• a to authorize addresses returned by a domain’s A/AAAA lookup.
• mx to authorize the addresses used by the domain’s MX hosts.

Publish one SPF policy, not several separate v=spf1 records

If two providers each give you an SPF example, merge the required mechanisms into a single record. Multiple SPF policies at the same name can produce a permanent error rather than a stronger policy.

Understand the DNS lookup limit

SPF limits the number of DNS-querying mechanisms used during evaluation. Nested provider includes can consume that budget quickly. If the policy becomes complex, audit the final record instead of continuing to append includes.

What ~all and -all mean

~all marks unmatched senders as a soft fail. -all is a stronger statement that unmatched senders are not authorized. Move to a strict policy only after you are confident every legitimate sender is represented.

SPF forwarding limitations

Traditional forwarding can break SPF because the forwarding server’s IP may not be authorized by the original sender’s domain. This is one reason modern email authentication also relies on DKIM and DMARC rather than SPF alone.

SPF and DMARC alignment are not the same thing

An SPF check can pass while DMARC still does not count it as aligned if the authenticated envelope domain does not align with the visible From domain. DKIM provides another path to DMARC alignment.

After changing SPF

1. Publish the TXT record at the correct DNS name.
2. Wait for DNS caches to expire according to the previous TTL.
3. Send tests through each legitimate provider.
4. Review message headers and DMARC reports when available.