/ Glossary — Authentication
What is SPF?
Sender Policy Framework — the DNS record listing which servers may send mail as your domain. The oldest authentication layer, and the easiest to break at scale. Here's how it works and where it fails.
/ Definition
SPF, or Sender Policy Framework, is a DNS record that lists the mail servers authorized to send email on behalf of your domain. When a receiving server gets a message claiming to be from you, it checks the connecting server's IP address against your published SPF record. If the IP is on the authorized list the message passes SPF; if not, it fails, signalling possible forgery.
SPF is the oldest of the three core authentication methods and the foundation the others build on, but it has a well-known weakness: it breaks when mail is forwarded, because the forwarding server's IP isn't on your list, and it's easy to misconfigure at scale. It works best paired with DKIM and tied together by DMARC. You can check any domain's SPF record with our SPF checker.
/ In practice
How SPF works
Your SPF record is a single TXT entry in your DNS that begins with v=spf1 and lists authorized sources — specific IP ranges, plus include statements that delegate to providers like your email platform. It ends with an "all" mechanism that says what to do with everything not listed: -all (hardfail, reject) is the strict, recommended setting, while ~all (softfail) is more permissive. A receiving server reads this record, finds the connecting IP, and returns a pass or fail that feeds into the DMARC decision.
The 10-lookup limit
SPF's most common failure is the ten-DNS-lookup limit. Every include and similar mechanism in your record requires a DNS lookup to resolve, and the specification caps the total at ten — exceed it and your SPF returns a permanent error that fails authentication entirely, even though the record looks fine. Each sending tool you add pushes you closer to the limit, so a record that worked last year can silently break as you grow. Our SPF checker counts your lookups recursively so you can see how close to the limit you are.
/ Common mistakes
Publishing more than one SPF record
The single most common SPF error after the lookup limit is having two SPF records on the same domain. The specification allows only one, and a receiver that finds two returns a permanent error that fails SPF entirely — often a result of two teams or two tools each adding their own record. The fix is to merge them into a single record with all the necessary include statements. Our SPF checker flags this immediately, because it's invisible until mail starts failing.
The deprecated ptr mechanism and flattening
Two more pitfalls are worth knowing. The ptr mechanism, which authorized senders by reverse DNS, is deprecated and actively ignored or penalized by major receivers — if it's in your record, remove it. And when you genuinely can't fit your sending sources under the ten-lookup limit, SPF flattening replaces include statements with the raw IP ranges they resolve to, trading maintainability for staying under the cap. Flattening needs care, because those IPs change and a flattened record can silently go stale, which is one more reason DKIM alignment is the more dependable path to a consistent DMARC pass.
A passing SPF record is the start. Keeping it under the limit as you grow is the work.
We manage SPF, DKIM, and DMARC together so your authentication stays correct as you add sending sources. Bring us your domain and we'll check what's passing.
Book infrastructure reviewRelated capabilities