Docs
Sender Policy Framework, or SPF, is a DNS-based allowlist for outbound mail. You publish a TXT record that says which servers may send mail for your domain, and receiving mail systems can check that claim.
SPF checks whether the sending server is authorized to use the domain in the SMTP envelope identity. It helps receivers reject or flag forged mail, but by itself it does not protect the visible From header the way DMARC alignment does.
In practice, SPF is one layer of modern email authentication next to DKIM and DMARC. If SPF is broken, real mail can fail delivery. If SPF is too loose, spoofed mail gets more room to operate.
These are the parts you will see most often inside a real SPF record.
| Mechanism | Meaning |
|---|---|
| v=spf1 | Marks the TXT value as an SPF policy. |
| ip4: / ip6: | Allows mail directly from specific IPv4 or IPv6 addresses or ranges. |
| include: | Delegates part of your SPF policy to another domain's SPF record. |
| a | Allows the IPs returned by the domain's A or AAAA records. |
| mx | Allows the IPs of the domain's MX hosts. |
| ~all | Soft fail: mail outside the policy is probably unauthorized. |
| -all | Hard fail: mail outside the policy is unauthorized. |
v=spf1 include:_spf.google.com include:sendgrid.net -all
This says: mail is allowed if it matches Google Workspace or SendGrid's SPF policy. Anything else should hard fail.
RFC 7208 is the authoritative SPF specification published by the RFC Editor in April 2014. It defines SPF record syntax, evaluation rules, the 10-lookup limit, and the result codes receivers use such as pass, fail, softfail, temperror, and permerror.
Official source: RFC Editor RFC 7208.
