SPF (Sender Policy Framework), defined in RFC 7208, lets a domain owner declare which mail servers are authorised to send on the domain's behalf. You publish one TXT record beginning v=spf1 at the domain root.
The record lists mechanisms such as ip4, ip6, a, mx, include and redirect, ending with an all qualifier: -all (hard fail), ~all (soft fail) or +all (pass everything, which you should never use). Receivers check the IP in the SMTP envelope, the return-path domain, not the visible From address.
SPF evaluation is capped at 10 DNS lookups; exceeding it returns permerror and the check fails. More than two void lookups also cause permerror. The ptr mechanism is deprecated and should not be used.
Because SPF breaks when mail is forwarded, it cannot stand alone. Pair it with DKIM under DMARC. If you are near the lookup limit, flattening resolves includes into raw IPs. Verify your record with the checker below.
Check it on your domain
- SPF Checker: validates SPF and counts DNS lookups against the limit of 10.
- SPF Generator: generates an SPF record from your list of senders.
- DMARC Checker: looks up and validates a domain's DMARC record and policy.