Digital Lexicon Hub

An email authentication standard that lets a domain publish, in DNS, which mail servers are authorized to send messages using that domain.

SPF is one of the checks Gmail, Yahoo and other providers use to trust a sender, so a missing or broken record lowers deliverability and makes it easier for attackers to send mail that appears to come from the company domain.

A company that sends through Google Workspace and a marketing platform publishes one TXT record at its root domain, v=spf1 include:_spf.google.com plus the platform's include value and ~all, then checks it stays within ten DNS lookups.

SPF checks the envelope sender (MAIL FROM), not the From address users see, and it usually fails when mail is forwarded. A domain may publish only one SPF record, and exceeding ten DNS lookups returns a permanent error that fails authentication.

Defined in RFC 7208, SPF is published as a TXT record beginning with v=spf1. Receivers evaluate the connecting IP against mechanisms such as ip4, ip6, a, mx and include, using the qualifiers +, -, ~ or ? to return pass, fail, softfail or neutral, with all as the final default. Terms that need DNS queries are limited to ten per evaluation. DMARC counts an SPF pass only when the checked domain aligns with the From header domain.