SPF record (Sender Policy Framework)

A list of servers allowed to send email on behalf of your domain - the foundation of anti-spoofing protection

📖 Detailed description

An SPF record (Sender Policy Framework) is a DNS entry that tells the world which servers are allowed to send emails from an address in your domain. If you are wondering what an SPF record is, picture a wedding guest list - the doorman (the recipient server) only lets in people who are on the list. A server that is not in your SPF record looks suspicious, so the message ends up in spam or gets rejected.

SPF is the first of three lines of email defense (alongside DKIM and DMARC). Without it, a scammer can send a message that looks like it came from you - and the recipient has no way to tell it is a fake. This is a real threat: impersonating company addresses is one of the most common ways to steal data and money.

How do you set up SPF? You add a single DNS record of type TXT that starts with v=spf1, lists the allowed servers (for example via the include: mechanism for your email provider), and ends with a rule such as ~all (soft fail) or -all (hard fail). A crucial rule: a domain may have only one SPF record, and the number of DNS lookups must not exceed ten - otherwise the record stops working.

You can check whether your domain has a valid SPF record, and how many DNS lookups it triggers, in seconds with our free DNS Lookup tool at /dns.

Most common problems

No SPF record

Anyone can send email "as you" - your mail lands in spam and customers receive fakes from your address

Two SPF records

The standard allows only one - with two, the whole mechanism is ignored

Too many DNS lookups

Above 10 DNS queries the record becomes invalid (a PermError)

A forgotten sending server

A newsletter or invoicing system is not on the list, so its emails land in spam

How to fix it?

Keep exactly one SPF record per domain - combine all servers into a single entry

Use the include: mechanism for providers (for example include:_spf.google.com for Google Workspace)

End the record with ~all at first, then switch to -all after testing

Audit the list regularly - add new sending systems and remove unused ones

Watch the 10 DNS lookup limit - flatten excess include: statements to specific IP addresses

Examples

Good example

v=spf1 include:_spf.google.com ~all

Bad example

no SPF record in DNS (or two separate v=spf1 records at once)

🔗 Related indicators

📧

DMARC record

The rule that tells servers what to do with mail that fails SPF and DKIM checks

📧

DKIM signature (DomainKeys Identified Mail)

A digital seal attached to every email - proof that the content was not altered in transit

🔐

DNSSEC (DNS security)

Digital signatures that guarantee a DNS answer was not swapped by an attacker

Check this indicator for your website

Get a detailed analysis and personalized tips on how to improve this element on your website.

Start free analysis