Glossary
DE / EN

Email authentication

What is SPF? Sender Policy Framework explained

SPF is a DNS record that defines which servers may send email on behalf of a domain. Receiving mail servers check it for every incoming message.

How SPF works

The SPF record is a TXT record at the domain itself that starts with "v=spf1". It lists the permitted senders: IP addresses (ip4, ip6), the servers from the domain's A or MX record, or – via "include" – the servers of a provider such as Microsoft 365 or a newsletter service.

It ends with a rule for every other server: "-all" (reject), "~all" (mark as suspicious) or "?all" (neutral). The receiving server compares the IP address of the delivering server with this list. It checks the sender address from the SMTP envelope (Return-Path), not the visible From address – that is what DMARC is for.

Domains that send no email at all should still publish SPF: "v=spf1 -all" tells every receiver that any message using this domain is forged. The same applies to active subdomains such as www or shop.

Example

example.com.      TXT  "v=spf1 mx include:spf.protection.outlook.com -all"
www.example.com.  TXT  "v=spf1 -all"

The main domain allows its own MX servers and Microsoft 365 and rejects everything else. The www subdomain sends no mail.

Common mistakes

  • Two SPF records on the same domain – SPF is then invalid (permerror).
  • More than 10 DNS lookups through nested includes – this also causes an error.
  • A new provider (newsletter, CRM, ticket system) sends mail but was never added.
  • "+all" or "?all" at the end – SPF then offers practically no protection.
  • The deprecated "ptr" mechanism, which RFC 7208 no longer recommends.

How the Domain Trust Check rates SPF

Criterion “SPF main domain” (weight 5 of 5): Exactly one valid SPF record (v=spf1), a clear policy for other servers (-all or ~all), at most 10 DNS lookups, all includes resolvable, no deprecated ptr mechanism.

Criterion “SPF for subdomains” (weight 5 of 5): Active subdomains such as www, mail or shop that send no mail should publish “v=spf1 -all” – or be covered by DMARC sp=reject so attackers cannot spoof them.

Standard: RFC 7208

Related terms