Glossary · ENCheck a domain

SPF

SPF helps a receiving mail system check whether a sending system is authorized to send email using a domain. The domain publishes rules for its use in the delivery information exchanged between mail systems, called the email's delivery envelope. A receiving mail system can compare the connecting sender with the domain's SPF policy. SPF helps detect some unauthorized sending, but it does not authenticate every part of a message or guarantee that a message is safe.

How does SPF work?

The domain publishes an SPF policy as a DNS TXT record. When a message arrives, the receiving system checks the sending IP address against the policy for the domain in that delivery information (the SMTP envelope). Usually, this is the domain in MAIL FROM, which gives the address for delivery failure notices. The result can indicate a match, a failure, or that the policy did not give a definitive answer.

For example, a business that sends mail through its provider adds the provider's authorized sending service to its SPF policy. If a recipient checks a message sent through that service, the sending address can match the published rule. The provider supplies the correct policy syntax; copying arbitrary SPF text can authorize the wrong senders or break existing mail.

What does SPF not prove?

SPF checks the domain in the delivery information, which can differ from the address a person sees in the message's From line. It also does not verify the message body. Forwarding can make SPF fail because the receiving system sees the forwarder's server rather than the original sender's server. DMARC helps connect authentication results to the visible From domain, while DKIM checks a digital signature on parts of the message.

An SPF record is not a DNS record type of its own: it is published as a TXT record. A domain should have one SPF policy at a given name; multiple SPF TXT records there can cause a permanent error.

Related terms