SPF

SPF, short for Sender Policy Framework, is a TXT record at your domain that starts with v=spf1 and lists the services allowed to send as you, usually with include: entries your mailbox provider documents, and ends with ~all or -all to say what to do with everything else. The receiving server looks at the domain in the message's return path, fetches its SPF record and checks whether the sending server is on the list.

Two rules from the standard cause most problems. A domain must have only one SPF record; two records make the check fail. And evaluating the record may take at most ten DNS lookups, counting include, a, mx, ptr, exists and redirect terms and the includes inside them; going over the limit is also a failure. On its own, SPF does not protect the From address people see; DKIM and DMARC do.

Sources: RFC 7208 (SPF) (rfc-editor.org, checked oct 22, 2026).