SPF

SPF (Sender Policy Framework) is an email authentication mechanism published as a TXT record in DNS. When a mail server receives a message, it looks up the SPF record for the sending domain and checks whether the connecting server's IP address is on the list of authorised senders.

An SPF record is a single string of mechanisms and modifiers. Common mechanisms include ip4: and ip6: for explicit addresses, a and mx to authorise hosts referenced by the domain's A or MX records, and include: to delegate to another domain's SPF record (for example a mail provider). The all mechanism at the end sets the default policy: -all is a hard fail, ~all is a soft fail, and ?all is neutral.

SPF has well-known limitations. Each evaluation is capped at 10 DNS lookups, and traditional forwarding breaks SPF because the forwarding server is not listed in the original domain's record. For these reasons SPF is normally deployed alongside DKIM and DMARC, which together form the foundation of modern email authentication.

A typical SPF record for a domain using Google Workspace looks like v=spf1 include:_spf.google.com -all, which authorises Google's servers and rejects everything else; a more elaborate one combines mx, an include: for a transactional sender, and explicit ip4: blocks for in-house relays. SPF also supports macros for advanced cases such as per-user policy, but most deployments avoid them for clarity. When the 10-lookup limit becomes a real risk — typically through nested include: chains — operators turn to *SPF flattening* tools that resolve the chain ahead of time and publish a single expanded record.