What is SPF (Sender Policy Framework)?

SPF (Sender Policy Framework) is a DNS TXT record in which a domain owner lists the mail servers permitted to send email using that domain in the envelope sender. A receiving server looks up the record when it sees the MAIL FROM command and compares the connecting IP against the list. SPF is defined in RFC 7208.

How an SPF record is written

An SPF record is a single TXT record at the domain name, beginning v=spf1 and ending with an all mechanism:

v=spf1 ip4:203.0.113.0/24 include:_spf.google.com -all

Each term is a mechanism, optionally prefixed by a qualifier. Mechanisms are evaluated left to right and the first match decides the result.

Mechanism	Meaning
`ip4:` / `ip6:`	This address or range may send.
`a` / `mx`	The A/AAAA addresses, or MX hosts, of the domain may send.
`include:`	Also allow whatever the named domain’s SPF allows.
`redirect=`	Use another domain’s record instead of this one.
`all`	Matches everything else.

The qualifier in front of all sets what happens to unlisted senders: -all is fail, ~all is softfail, ?all is neutral, and +all allows everyone (never publish that).

The 10-lookup limit

Every include, a, mx, ptr, exists and redirect costs one DNS lookup, and nested includes add theirs. RFC 7208 caps the total at 10. Past the cap the receiver returns permerror and treats the record as broken, so SPF fails for every message. Growing companies hit this limit by accumulating includes for CRMs, ticketing systems and marketing tools. The SPF checker counts them.

What SPF does not do

SPF checks the envelope sender (the MAIL FROM address), not the From: header the recipient sees. A spammer can pass SPF for their own domain while displaying yours. That gap is why DMARC requires the SPF domain to align with the visible From domain.

SPF also breaks on plain forwarding, because the forwarding server is not in the original domain’s list. DKIM survives forwarding, which is why the two are used together.

SPF at the SMTP handshake

Because SPF needs only the connecting IP and the MAIL FROM domain, it can be evaluated before the message body is transmitted. Spamjadoo does exactly that: a hard SPF failure against a domain with -all is answered with a 550 during the session, and the sender’s server generates the bounce.

Last reviewed 10 September 2026 by Spamjadoo engineering.