What is SPF?
SPF (Sender Policy Framework, RFC 7208) is a single TXT record on your domain listing which hosts are authorised to send mail for it. A receiver evaluates it against the IP that connected and the domain in the SMTP envelope, and returns one of: pass, fail, softfail, neutral, none, temperror or permerror.
How the record is read
A record looks like v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all. It is evaluated left to right; the first mechanism that matches the connecting IP decides the result, and evaluation stops there.
The qualifier on the final all decides what happens to everything unmatched: -all is a fail (hard), ~all a softfail, ?all neutral, +all an explicit pass for the entire internet — which is the same as publishing nothing at all, only slower.
The mechanisms that cost a lookup
include, a, mx, ptr, exists and the redirect modifier each require a DNS query, and the count is cumulative across the whole recursive evaluation — not per record. RFC 7208 §4.6.4 caps that at ten. Above it the result is permerror.
ip4: and ip6: cost nothing, which is why replacing an include with the ranges behind it is the standard way back under the limit. ptr is deprecated (§5.5) and should not be used at all.
The failure modes worth knowing
Three break a record outright rather than degrading it.
- Two
v=spf1records on one name: apermerror. This is the classic result of adding a second provider by publishing a second record instead of editing the first. - More than ten DNS lookups: a
permerror, and apermerroris treated as a fail by most receivers. - More than two void lookups (a query returning no records): also a
permerrorunder §4.6.4.
What SPF does not do
SPF authenticates the envelope sender, not the From header the recipient sees, and it does not survive forwarding: a forwarding service rewrites the envelope, so the original SPF pass is lost. Only an aligned DKIM signature survives that. This is why SPF alone is not sufficient and DMARC asks for either one, aligned.
The scan at the bottom of this page counts your lookups recursively, shows every record it followed, and flags a second record or a missing all.
Frequently asked questions
Should I use -all or ~all?
Under DMARC the difference is small: the DMARC policy decides the disposition, and a softfail that does not align is still a DMARC fail. -all is stricter for receivers that evaluate SPF standalone, but it turns a forgotten sender into a hard rejection rather than a filtered message.
Do I need an SPF record on a subdomain?
Only if mail is sent from it. SPF is not inherited: a subdomain with no record of its own returns none, not the apex policy. That is the opposite of DMARC, which does inherit through sp=.