Glossary
SPF (Sender Policy Framework)
SPF (Sender Policy Framework) is an email authentication standard. A domain publishes a DNS TXT record listing the servers allowed to send mail for it, and receiving servers check each message's sending IP against that list.
What Is SPF (Sender Policy Framework)?
In short An SPF record is one TXT record on the domain that starts with v=spf1, for example v=spf1 include:_spf.google.com ~all.
When a message arrives, the receiving server takes the domain from the envelope sender (the Return-Path, not the From address people see), looks up its SPF record and checks whether the connecting IP is allowed. The result is pass, fail, softfail, neutral, none or an error.
Two limits catch people out. A domain can have only one SPF record, so adding a sending tool means editing the existing record. And SPF evaluation may trigger at most 10 DNS lookups through include, a, mx, ptr, exists and redirect. More than one record, or more than 10 lookups, gives a permanent error, and SPF no longer passes.
SPF Example
Example: a company sends from Google Workspace and one marketing tool, with v=spf1 include:_spf.google.com include:spf.example-esp.com ~all. Before adding a third tool it counts lookups, because each include can contain more lookups of its own, and the total must stay at 10 or below.
SPF in Practice
SPF alone does not protect the From address. DMARC does that, by requiring SPF or DKIM to pass for a domain that matches the From domain. Google requires SPF or DKIM from every sender and both, plus DMARC, from bulk senders, so a cold email domain without a correct SPF record starts at a disadvantage.
FAQ
What is an SPF record?
A DNS TXT record, starting with v=spf1, that lists the servers allowed to send mail for your domain. Receiving servers check the sending IP against it.
Can a domain have two SPF records?
No. RFC 7208 says that more than one SPF record makes the check return a permanent error, so SPF fails for all of your mail. Merge every sender into one record.
What is the SPF 10 lookup limit?
SPF evaluation may trigger at most 10 DNS lookups across include, a, mx, ptr and exists mechanisms and the redirect modifier. Past that the result is a permanent error. Includes can contain their own lookups, so a record with several third-party includes reaches the limit fast.
What is the difference between ~all and -all?
-all means fail: mail from any server not listed is not authorized. ~all means softfail: probably not authorized, so receivers usually accept the message but treat it with suspicion. If you publish DMARC, its policy decides what happens to mail that fails.
Does Gmail require SPF?
Google requires SPF or DKIM from all senders. Bulk senders, which Google defines as those sending 5,000 or more messages a day to Gmail accounts, need SPF, DKIM and DMARC.
Do This in Ken
Do This in Ken
Delivery handles DNS setup for the domains and mailboxes it provisions, then checks SPF on every sending domain and shows pass or fail, so you don't edit TXT records by hand.
- Module
- Delivery
- Open in Ken
- /features
The new Ken opens to the waiting list in batches.
Related
- GTM Glossary
Every GTM term, grouped by topic.
- DKIM (DomainKeys Identified Mail)
- DMARC
- MX record
- Sender reputation
- Email warmup
- Ken
Sources
| Source | Checked |
|---|---|
| RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1 | |
| Google: Email sender guidelines |
Changelog
- Page published.