What Is an SPF Record and How Does It Work?
SPF (Sender Policy Framework) records tell receiving mail servers which IP addresses are authorised to send email for your domain. Here is how to read and set one correctly.
ProfitTool Team
Security & Dev
The Problem SPF Solves
Without SPF, anyone can send an email claiming to be from your domain. A forged From: header costs nothing and is trivially easy for spammers and phishers. SPF adds a DNS-based list of authorised sending servers, giving receiving mail services a way to check whether a message actually came from a legitimate source.
How SPF Works
- You publish a TXT record at your domain root:
example.com IN TXT "v=spf1 include:sendgrid.net ip4:203.0.113.10 -all" - When a receiving server gets email claiming to be from
@example.com, it looks up that TXT record. - It checks whether the sending server's IP is covered by the policy.
- The result is PASS, SOFTFAIL or FAIL.
Reading an SPF Record
| Mechanism | Meaning |
|---|---|
ip4:203.0.113.10 | Allow this specific IPv4 address |
ip4:203.0.113.0/24 | Allow this IPv4 range |
include:sendgrid.net | Also check SendGrid's SPF policy |
a | Allow the domain's own A record IPs |
mx | Allow the domain's MX server IPs |
~all | Soft fail — accept but mark unlisted senders |
-all | Hard fail — reject unlisted senders (recommended) |
Common Mistakes
- Too many DNS lookups: SPF allows a maximum of 10 DNS lookups per evaluation. Each
include:andacounts. Exceeding 10 causes a PermError. - Using
+all: This passes every sender, completely defeating SPF. - Missing
-all: Without a terminating all mechanism, the result defaults to neutral — no protection. - Forgetting subdomains: SPF only covers the exact domain unless you add separate records for subdomains.
SPF Alone Is Not Enough
SPF only validates the envelope from address (the SMTP MAIL FROM), not the visible From: header in the email client. Attackers can still spoof the displayed sender. This is why DMARC ties SPF and DKIM results to the visible From domain.
Use our SPF Record Checker to instantly look up and analyse any domain's SPF policy.
ProfitTool Team
Security & DevWritten and maintained by the ProfitTool team. Where an article references a ProfitTool utility, the behaviour described is the behaviour of the tool on this site — you can open it and check the output yourself.
More from the Knowledge Hub
SPF vs DKIM vs DMARC: How Email Authentication Works
SPF, DKIM and DMARC work together to protect your domain from email spoofing and phishing. This guide explains what each one does and why you need all three.
Privacy & SecurityWhat Is DKIM and How Does Email Signing Work?
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing emails so receiving servers can verify the message was not altered in transit and came from the stated domain.
Privacy & SecurityWhat Is DMARC and How Do You Set It Up?
DMARC builds on SPF and DKIM to give domain owners control over what happens to unauthenticated email. This guide covers how DMARC works and how to configure it safely.