What is an SPF Record?
A Sender Policy Framework (SPF) record is a type of DNS TXT record that specifies which mail servers are authorized to send email on behalf of a specific domain. When an email is received, the recipient's mail server checks whether the sending server's IP address is listed in the sender domain's SPF record.
If the sending server is not listed, the email can be flagged as suspicious, moved to spam, or rejected — depending on the domain's DMARC policy.
How to Read an SPF Record
v=spf1— Version declaration. All SPF records start with this.include:— Delegates authorization to another domain's SPF record (e.g., Google Workspace, Mailgun).ip4: / ip6:— Directly authorizes a specific IP address or range.~all— Soft fail: unauthorized servers are accepted but flagged. Use -all for hard fail (reject).-all— Hard fail: unauthorized servers are rejected. The most secure option when your infrastructure is fully mapped.Why Check a Domain's SPF Record?
- Verify that an online store or service has properly configured email security — a sign of a legitimate, maintained operation.
- Detect domains that lack SPF, which can be exploited to send phishing emails impersonating that brand.
- Troubleshoot email deliverability if your own emails are landing in spam folders.
- Confirm that third-party senders (CRM, newsletters, billing) are authorized in your own SPF record.
SPF as a Legitimacy Signal
When evaluating an unknown website before making a purchase, the presence and quality of an SPF record is a meaningful signal:
- SPF record exists and is well-formed
- Uses recognized providers (Google, Microsoft, SendGrid)
- Ends with
-all(hard fail)
- No SPF record published at all
- Record ends with
+all(allows any server) - Domain is new (<6 months old) with no SPF
Frequently Asked Questions
What happens if a domain has no SPF record?
Without an SPF record, any server can send email claiming to be from that domain. This makes it trivially easy for attackers to impersonate the domain in phishing campaigns, and emails are more likely to be flagged as spam by modern mail filters.
Does SPF alone protect against phishing?
No. SPF works best in combination with DKIM (DomainKeys Identified Mail) and DMARC. SPF only verifies the envelope sender (the server that sent the message), not the From header that users see. Full protection requires all three protocols aligned through DMARC.
Can a domain have multiple SPF records?
No. A domain must have exactly one SPF record. Having multiple SPF TXT records causes a permanent error (PermError) during validation, which means the record will be ignored entirely. Multiple authorized senders should be combined in a single record using include: mechanisms.