What is SPF?
SPF is one of the three core email authentication standards, and it answers a simple question: which servers are allowed to send email for your domain? SPF stands for Sender Policy Framework, and it works as a public list, published in your DNS, of the mail servers you authorise. When a receiving server gets a message claiming to be from you, it checks that list. If the sending server is not on it, the message can be marked as suspicious or rejected.
What is SPF and why does it matter?
Email was never designed with sender verification built in, so by default anyone can claim to send from your domain. SPF was created to fix that. By publishing an SPF record, you make it possible for the rest of the internet to tell your real mail servers from an impostor. This cuts down on spoofing and phishing that abuse your brand, and it improves your legitimate deliverability, because mailbox providers trust domains that authenticate their mail.
How SPF works
Your SPF record is a single DNS TXT entry that begins with v=spf1 and lists the sources permitted to send for your domain, followed by a rule for everything else. When a mail server receives a message, it looks up the SPF record for the sending domain and compares the connecting server against the list. The record ends with an instruction that tells receivers how strict to be about senders that are not listed.
SPF mechanisms and syntax
- include authorises another provider’s servers, such as your email host or marketing platform.
- a and mx authorise the servers named in your domain’s A or MX records.
- ip4 and ip6 authorise specific server addresses directly.
- -all is a hard fail that tells receivers to reject anything not listed, while ~all is a soft fail that marks it suspicious. A hard fail gives the strongest protection.
A typical record might read v=spf1 include:_spf.google.com include:sendgrid.net -all, authorising two providers and rejecting everything else.
The SPF ten-lookup limit
SPF has an important constraint: evaluating the record must not require more than ten DNS lookups. Every include and similar mechanism counts toward that limit, and stacking too many providers pushes you over it, which causes SPF to fail entirely. This is one of the most common real-world SPF problems, and flattening or consolidating includes is often the fix. Our guide on how to fix an SPF record covers this in detail.
SPF, DKIM and DMARC together
SPF is powerful but incomplete on its own, because it breaks when mail is forwarded and it checks a hidden envelope address rather than the from line your recipients see. That is why it works best alongside DKIM and under a DMARC policy, which adds the alignment and enforcement SPF lacks. Together the three form a complete email authentication stack.
Do you still need SPF in 2026?
Yes. Even though SPF has known weaknesses, it remains a required building block, not an optional extra. Major mailbox providers now expect bulk senders to authenticate their mail, and SPF is one of the checks they run before deciding whether a message reaches the inbox or the spam folder. A domain with no SPF record looks unconfigured and untrustworthy, and it cannot satisfy a DMARC policy that relies on SPF for one of its two authentication paths. The realistic position is that SPF on its own is not enough, but SPF as part of a complete setup with DKIM and DMARC is essential. If your domain sends any email at all, whether transactional receipts, newsletters or ordinary business correspondence, you need a correct SPF record, and you need to keep it current as you add and remove the services that send on your behalf.
How to check your SPF record
An SPF record can look fine yet still fail because of the lookup limit, a soft fail where you wanted a hard fail, or a missing provider. Run a security scan with EzyAudit AI and you will see whether SPF is published, whether it is within the lookup limit, and whether it aligns with your DMARC policy, all in plain language. Review the full range of checks we run. For the formal specification, SPF is defined in IETF RFC 7208.
A correct SPF record is the foundation of trustworthy email and the first step toward a domain that cannot be easily spoofed. Scan your website now to see whether your SPF record is doing its job.