Home / Learn / What is SPF?

What is SPF?

SPF is a DNS record that lists the servers allowed to send email for your domain, so receivers can spot forged mail.

Updated 2026-10-18

TL;DR

  • SPF (Sender Policy Framework) is a TXT record in DNS that says which servers may send mail for a domain.
  • Receivers compare the sending server with that list. The record ends in -all (fail) or ~all (softfail).
  • An SPF record has a hard limit of 10 DNS lookups. Going over gives a permerror and the check fails.

The short definition

SPF lets a domain owner publish which hosts may send mail using that domain. The standard says that email can be forged because existing protocols don't restrict the "MAIL FROM" or HELO domain a sending host uses, and SPF lets receivers check whether a host is authorised (RFC 7208, checked 2026-10-18). The check uses the envelope sender (the return path), not the visible From address.

What an SPF record looks like

example.com.  IN TXT  "v=spf1 ip4:203.0.113.10 include:_spf.google.com -all"
  • v=spf1 marks the record as SPF.
  • ip4: authorises one address. include: pulls in another sender's list, such as your mail provider.
  • -all means anything not listed fails. ~all is a softfail.

RFC 7208 calls -all an explicit statement that the client is not authorised, and ~all a weak statement that the host is probably not authorised, which receivers should not reject on alone.

The 10-lookup limit

SPF implementations must limit the DNS-querying terms in a record to 10. The terms that count include include, a, mx, ptr, exists and redirect. Go over and the result is permerror. Teams that add a new tool for every task often hit this without noticing, so check the count whenever you add a sender.

Why SPF matters for senders

  • Gmail requires it. Google says all senders must set up SPF or DKIM, and bulk senders (more than 5,000 messages a day to Gmail) need both plus DMARC (Google email sender guidelines, checked 2026-10-18).
  • Cold-email domains need it. A new sending domain with no SPF starts with a handicap before a single bounce happens. Pair it with a clean list: how many bounces burn a domain.
  • SPF alone does not stop spoofing of the visible From address. That is what DMARC adds.

SPF and email verification

Our checks don't read your SPF record: verification asks a recipient's server about a mailbox, and SPF is about the sender. The link is practical. If you send to a list that has not been cleaned, a rising bounce rate hurts the reputation of the domain that SPF protects. Start with how verification works and bounce codes.

Authentication is not verification. SPF, DKIM and DMARC describe how a domain sends mail. They do not say whether a mailbox exists. Mail Exchange checks the second thing (syntax, MX, risk lists, SMTP mailbox check and a catch-all test), so use both: authenticate your sending domain and verify your list.

To see your own record, use the free email authentication checker, which checks SPF, DKIM, DMARC and MX for up to 25 domains.

Sources

Common questions

What is SPF in email?

SPF is a DNS record listing the servers allowed to send mail for a domain. Receivers check the sending server against it.

What is the difference between -all and ~all?

-all says mail from unlisted servers should fail. ~all is a softfail, a weaker statement that receivers should not reject on alone.

Does SPF check if an email address exists?

No. SPF is about who may send mail for a domain. To check whether a mailbox exists you need email verification.

Related

Start your free trial →