SPF (Sender Policy Framework) is a DNS record that lists the servers allowed to send email for a domain, so receivers can detect unauthorized senders.
Sender Policy Framework (SPF) is an email authentication standard, defined in RFC 7208, that lets a domain owner publish which mail servers may send email using that domain. Receiving servers check the sending server's IP address against this list. SPF is one of three building blocks, together with DKIM and DMARC, that protect a domain against spoofing.
How it works
SPF is published as a TXT record on the domain, for example v=spf1 include:_spf.mailprovider.example ip4:192.0.2.10 -all. Mechanisms such as include, ip4, ip6, a and mx list the permitted senders, and the final -all (fail) or ~all (softfail) says how to treat everyone else. The receiver checks the domain in the envelope sender (Return-Path), not the From address the reader sees. That is why SPF alone does not stop From-address spoofing; DMARC adds the requirement that the checked domain align with the visible one. RFC 7208 also limits evaluation to 10 DNS lookups, and records that exceed it return a permanent error. SPF often fails on forwarded mail, because the forwarding server is not on the original domain's list.
Example
An illustrative case: a fictional company sends mail from its own server and through a newsletter service, and its SPF record includes both. A forged message sent from an unrelated server fails SPF. With DMARC at enforcement, the receiving server rejects it.
How to spot problems
- The domain has no SPF record, or the record ends with
+all, which authorizes anyone. - Too many nested includes push the record past the lookup limit.
- DMARC reports show legitimate services failing SPF.
- Domains that never send mail have no
v=spf1 -allrecord. - There is more than one SPF record on the same domain, which is invalid.
What brands can do
- List every service that sends mail for you and include each one.
- End the record with
-allor~all, and rely on DMARC enforcement for the final decision. - Keep lookups under the limit by removing unused includes.
- Publish
v=spf1 -allon domains that do not send email.
SPF protects your exact domain only. Lookalike domains need monitoring and takedown, which is the work Phishvoid does; contact the team for details. See SPF, DKIM and DMARC against email spoofing for setup guidance.
Read more: SPF, DKIM and DMARC: Stop Spoofed Email in Your Brand’s Name
Seeing this against your brand?
We find and take down phishing and impersonation sites. Tell us what you are seeing.