What Is SPF (Sender Policy Framework)?

SPF (Sender Policy Framework) is an email authentication method: a TXT record in your domain's DNS that lists the servers allowed to send email on your behalf. Receiving mail servers check it to decide whether an email claiming to be from your domain is legitimate.

Why it matters

• Helps stop spammers from spoofing your domain
• Is required (along with DKIM and DMARC) by Gmail and Yahoo for bulk senders
• Improves inbox placement when set up correctly

What an SPF record looks like

v=spf1 include:_spf.google.com include:spf.your-smtp-provider.com ~all

• include: authorises a service's servers
• ~all soft-fails everything else (-all is stricter)

Common mistakes

• Two SPF records on one domain, which breaks both. Merge them into one
• More than 10 DNS lookups, which causes failures
• Forgetting a sending service (CRM, helpdesk, invoicing tool)

Example

A company sends from Google Workspace and a marketing SMTP service, so its single SPF record includes both, and emails from either pass SPF.

Related terms

DKIM · DMARC · SMTP · Email deliverability

Guide: SPF, DKIM & DMARC explained.