Cybersecurity glossary
What is Sender Policy Framework (SPF)?
Learn what SPF is, how SPF TXT records authorize outbound mail servers, and why SPF should be deployed with DKIM and DMARC rather than alone.
Definition
Sender Policy Framework (SPF) is an email-authentication mechanism in which a domain publishes a DNS TXT record listing which hosts are allowed to send mail for that domain in envelope-level SMTP contexts.
Why SPF matters
A domain without SPF makes it easier for unauthorized infrastructure to claim it is sending mail on that domain’s behalf. SPF gives receivers a published DNS policy they can consult during SMTP to decide whether the connecting host belongs on the approved sender list. That policy is useful, but limited. SPF authenticates sending infrastructure at the envelope level, not the visible From address that users recognize most. That is why SPF is strongest when paired with DKIM and enforced through DMARC.
What an SPF record expresses
Authorized sources
The record lists IP ranges, hosts, or included policies that are allowed to send mail for the domain.
Evaluation mechanisms
Mechanisms such as `ip4`, `include`, `a`, and `mx` tell receivers how to test the sending host against the policy.
Result qualifiers
A record can end with soft or hard guidance such as `~all` or `-all` to indicate how unauthorized senders should be viewed.
Envelope-level scope
SPF is applied to SMTP identities such as the MAIL FROM or HELO/EHLO domain rather than the human-visible From header.
How SPF evaluation works
A sending host opens an SMTP connection
The recipient mail server observes the connecting IP and the envelope identity used for the message.
The receiver extracts the relevant domain
SPF is evaluated against the MAIL FROM domain or, in some cases, the HELO/EHLO identity.
The SPF TXT record is queried
The recipient looks up the published policy for that domain in DNS.
Mechanisms are processed in order
The receiver walks through the SPF policy and tests whether the sending IP matches the allowed conditions.
An SPF result is produced
The evaluation ends with a result such as pass, fail, softfail, neutral, permerror, or temperror.
DMARC may use the result for alignment
If the SPF-authenticated domain aligns with the visible From domain, the outcome becomes much more useful for anti-spoofing decisions.
SPF results and what they imply
The outcome matters less as an abstract status code and more as an input into mailbox filtering and DMARC policy.
| Element | What it means | Why it matters |
|---|---|---|
| Pass | The sending host matches the published SPF policy for the evaluated domain. | This is useful, but only becomes strong brand protection when the result aligns with the visible From domain under DMARC. |
| Softfail | The domain suggests the sender is probably unauthorized but does not request outright hard rejection. | Softfail is often a transitional posture while organizations inventory and clean up their sender ecosystem. |
| Fail | The sender is explicitly outside the authorized policy, typically signaled by `-all`. | This gives receivers a clearer reason to distrust or block the message when other local policy supports it. |
| Permerror or lookup failure | The SPF record is malformed or too complex, often because of nested includes or syntax mistakes. | A broken SPF policy can undermine both deliverability and anti-spoofing confidence. |
SPF operating practices that hold up in production
SPF failures are often inventory failures: the record and the real sender estate stop matching each other.
- Inventory every third-party sender, ticketing tool, CRM, marketing platform, and appliance that uses your domains for outbound mail.
- Keep SPF policies under the 10-DNS-lookup limit by reviewing nested `include` chains and simplifying where possible.
- Publish SPF at the correct domain and ensure the return-path strategy aligns with how each sender actually operates.
- Use `~all` or `-all` deliberately rather than copying examples without understanding the enforcement and delivery impact.
- Retire old vendors from the record quickly so abandoned infrastructure does not stay implicitly authorized forever.
- Treat SPF changes as change-managed DNS updates because a typo can affect both security and business mail delivery.
- Pair SPF with [DKIM](/glossary/domainkeys-identified-mail-dkim) because forwarding can break SPF even when the message is otherwise legitimate.
- Measure SPF in the context of [DMARC](/glossary/domain-based-message-authentication-reporting-and-conformance-dmarc) alignment rather than as a standalone badge of safety.
SPF is necessary but not sufficient
SPF is good at answering one narrow question: “Was this sending host authorized for this envelope identity?” That is useful, but it is not the same as “Does this message visibly come from the brand the user thinks it does?” Because forwarding can also break SPF, a pass is not always durable and a fail is not always malicious. That complexity is exactly why DKIM and DMARC exist beside it.
The practical takeaway
SPF is the DNS policy that tells receivers which servers are allowed to send mail for a domain in envelope-level SMTP contexts. The practical takeaway is to publish a precise SPF record, keep it within lookup limits, and treat it as one layer of a mail-authentication stack that also includes DKIM and DMARC.
Related security terms
Email Spoofing
SPF helps receivers detect unauthorized infrastructure trying to send mail for a domain.
DomainKeys Identified Mail (DKIM)
DKIM complements SPF by signing message content rather than just authorizing hosts.
Domain-Based Message Authentication, Reporting and Conformance (DMARC)
DMARC aligns SPF and DKIM with the visible From domain to create a real anti-spoofing policy.
TXT Record
SPF is commonly published as a specially formatted DNS TXT record.
MX Record
SPF evaluation is part of mail handling, even though it is not stored in MX records themselves.
Frequently asked questions
What is SPF in simple terms?
SPF is a DNS-published list of which servers are allowed to send mail for a domain.
Does SPF stop all spoofed email?
No. It helps with direct-domain spoofing, but it does not authenticate the visible From header on its own and can break across forwarding.
Why is SPF stored in TXT records?
That is the deployment model standardized for SPF, so the policy is published in DNS as structured TXT data.
What is the difference between SPF and DKIM?
SPF authorizes sending hosts. DKIM signs the message itself so recipients can verify it was authorized and not altered.
Why does DMARC matter if SPF already exists?
DMARC ties SPF and DKIM results to the visible From domain and tells receivers whether to reject or quarantine failures.
What is the SPF DNS lookup limit?
SPF evaluation has a practical limit of 10 DNS-mechanism lookups, so complex policies can fail if they chain too many includes or lookups.
References
Explore authoritative guidance and frameworks related to sender policy framework (spf).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.