Glossary

SPF (Sender Policy Framework)

Authorises which mail servers can send email for your domain

SPF (Sender Policy Framework) is a DNS-based email authentication standard that lets domain owners specify which mail servers are permitted to send email on their behalf, helping receiving servers detect and reject forged sender addresses.

What is SPF?

SPF, or Sender Policy Framework, is an email authentication protocol defined in RFC 7208. It allows domain owners to publish a list of authorised mail servers in their DNS records, so that receiving mail servers can verify whether an incoming message was sent from a server the domain owner trusts.

Without SPF, anyone can send an email claiming to be from your domain. Spammers and phishers exploit this to impersonate legitimate businesses. SPF closes this gap by giving receivers a way to check the sending server's IP address against the domain's published policy.

An SPF record is stored as a TXT record in DNS. It begins with the version tag "v=spf1" followed by mechanisms that define allowed senders and ends with an "all" qualifier that tells receivers what to do with mail that doesn't match — typically "~all" (soft fail) or "-all" (hard fail).

How Does SPF Work?

When a receiving mail server accepts an incoming connection, it looks at the IP address of the server making the connection. It then fetches the SPF TXT record for the domain found in the envelope "From" address (also called the MAIL FROM or Return-Path address).

The receiver walks through the SPF record's mechanisms — such as "ip4:", "include:", and "a" — to determine whether the sending IP is authorised. If a match is found, the result is "Pass." If no mechanism matches, the final "all" qualifier determines the outcome: "-all" means Fail, "~all" means SoftFail, "?all" means Neutral.

SPF alone does not protect the visible "From" header that users see in their email client. That is why SPF is most effective when combined with DKIM and DMARC, which together provide alignment between the envelope sender and the header sender.

How to Check Your SPF Record

You can verify your domain's SPF record instantly using the SPF Checker at nslookup.net/tools/spf-checker. Enter your domain name and the tool will fetch the live TXT record from DNS, parse each mechanism, validate the syntax, and highlight any issues such as exceeding the 10 DNS lookup limit.

Regularly checking your SPF record is important because adding new email services — marketing platforms, CRMs, or support tools — often requires updating the record. An outdated or broken SPF record can cause legitimate email to land in spam.

Related Tool

SPF Checker

Try the Tool →

Frequently Asked Questions

Does SPF stop all email spoofing?

SPF only protects the envelope sender (Return-Path), not the visible "From" header that end users see. Attackers can still spoof the display name or header From address even if SPF passes. DMARC is needed to enforce alignment between the envelope sender and the header From address, providing stronger protection against spoofing.

What is the SPF 10-lookup limit?

The SPF specification allows a maximum of 10 DNS lookups when evaluating a record. Mechanisms like "include:", "a", "mx", and "exists" each count toward this limit. Exceeding 10 lookups causes a "PermError," which can result in SPF failing for all mail. SPF flattening is a technique used to reduce lookup count by replacing includes with their resolved IP addresses.

Should I use ~all or -all?

The "-all" (hard fail) qualifier instructs receivers to reject mail that does not match your SPF record, providing the strictest policy. The "~all" (soft fail) qualifier marks non-matching mail as suspicious but still delivers it. Most security experts recommend starting with "~all" while setting up DMARC, then moving to "-all" once you are confident your SPF record is complete.

Can a domain have multiple SPF records?

No. RFC 7208 explicitly states that a domain must have at most one SPF TXT record. If multiple SPF records are published, the result is a "PermError" and SPF evaluation fails. If you need to authorise multiple sources, combine them into a single SPF record using the "include:" mechanism.