SPF

Definition

SPF is a TXT record published at a domain's root listing the servers allowed to send mail in its name. The receiving server checks the sending server's address against that list, and the answer comes back as one of three: authorized, refused, or no opinion at all.

The first of the three, and the simplest

Without SPF, any machine on the internet can open a connection and announce that it is writing from your client's domain: the mail protocol, as designed, asks for no proof at all. SPF supplies that proof from the domain's side, in a single line published at its root.

What it does not do deserves saying plainly: SPF does not protect the address your recipient sees in their mail client. The check applies to the address announced during the server-to-server conversation, and the two can differ — which is exactly what fraudulent mail exploits. DMARC is what requires them to match.

A complete record

One authorized platform, one authorized server, and the fate of everything else.

example.com. 3600 IN TXT "v=spf1 include:_spf.example.net ip4:203.0.113.25 -all"

“include” pulls in a provider's own list, whose addresses can change without involving you. The final term decides what happens to anything that matched nothing: the dash asks for an outright rejection, a tilde would ask only for a flag.

The usual mistake

Stacking up “include” terms as tools get added. Evaluating an SPF record stops after ten DNS lookups, and past that point it fails — even when the list itself is perfectly correct. The domain becomes suspect with no line looking wrong.

How to avoid it: Count the “include” terms, including the ones your providers add inside their own lists, replace whatever never changes with address ranges, and remove the tools you no longer use. The ten-lookup budget is not negotiable.

Source: SPF is defined in RFC 7208: published as TXT, one record per domain, and a ceiling of ten DNS lookups per evaluation.

Related terms

Where to go next

Knowing the words is half the job

The other half is knowing which of your domains is about to become a problem. DomainVigil watches expiry, DNS, certificates and reputation, and tells you before your client does.

Start for free

Five domains free, forever. No card required.

Back to the glossary