Skip to content
Clinic open · free diagnosis, no appointment needed2,000+ domains monitored

SPF

Sender Policy Framework: a DNS TXT record listing the servers authorised to send mail using a domain in the SMTP envelope sender. Defined in RFC 7208.

Sumit Raj · reviewed

Sender Policy Framework. A published list of the servers allowed to send for a domain.

SPF checks the envelope sender, the address given in the SMTP MAIL FROM command, which recipients never see. That makes it narrower than most people assume: it does not stop anybody putting your domain in the visible From header. Tying authentication to that header is DMARC’s job.

The mechanism that catches people is the ten DNS lookup limit in RFC 7208 section 4.6.4. Lookups inside your includes count against the same ten, so a short record can be over the limit through a vendor’s record. Past ten, receivers return PermError and SPF fails for every message.

Related

  • DKIMDomainKeys Identified Mail: a cryptographic signature added to outgoing messages and verified against a public key published in the sending domain's DNS. Defined in RFC 6376.
  • DMARCDomain-based Message Authentication, Reporting and Conformance: a DNS record that requires SPF or DKIM to pass for the visible From domain, and instructs receivers what to do when neither does. Defined in RFC 9989.
  • PermErrorThe SPF result meaning the record could not be evaluated because it is invalid or exceeds a processing limit. It is a failure, not a neutral outcome, and applies to every message the domain sends. Defined in RFC 7208 section 2.6.
  • What is SPF?A published list of the servers allowed to send for your domain, and the ten-lookup limit that quietly breaks a lot of them.
  • SPF TestFull chain walk with the exact 10-lookup count, plus the void lookups nobody else checks.

Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.