SPF Explained

Learn how SPF works and how DMARC Monitor helps you keep your SPF record healthy.

What is SPF?

SPF (Sender Policy Framework) is a DNS record that specifies which mail servers are authorized to send email on behalf of your domain. When a receiving server gets an email claiming to be from your domain, it checks your SPF record to verify the sender is legitimate.

How SPF Works

  1. Someone sends an email claiming to be from your domain (e.g., user@yourdomain.com)
  2. The receiving mail server looks up the SPF record for yourdomain.com
  3. The server checks if the sending IP is in your authorized list
  4. If the IP matches, SPF passes. If not, SPF fails.

SPF Record Structure

An SPF record is a TXT record at your domain's root. Here's an example:

v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.5 -all

This record authorizes Google Workspace, SendGrid, and a specific IP address to send email.

SPF Mechanisms Explained

MechanismDescription
include:Include another domain's SPF record (e.g., for email services)
ip4:Authorize a specific IPv4 address or range
ip6:Authorize a specific IPv6 address or range
aAuthorize your domain's A record IP
mxAuthorize your domain's MX servers
allCatch-all for IPs not matching other mechanisms

SPF Qualifiers

+

Pass (default)

IP is authorized

-

Fail

IP is NOT authorized (recommended for -all)

~

SoftFail

IP is probably not authorized (email may still be delivered)

?

Neutral

No assertion about the IP

Common SPF Issues

Too Many DNS Lookups

SPF has a 10 DNS lookup limit. Each include: counts as a lookup. DMARC Monitor warns you when you're approaching this limit.

Missing Email Services

Forgot to add a service like Mailchimp or HubSpot? You'll see SPF failures in your DMARC reports. DMARC Monitor helps identify which services you need to add.

Multiple SPF Records

You can only have ONE SPF record per domain. Multiple records cause SPF to fail. Combine all mechanisms into a single record.

How DMARC Monitor Helps

  • SPF validation: We check your SPF record for syntax errors and warn about issues
  • DNS lookup counting: Track how many lookups your SPF uses (max 10)
  • Source discovery: DMARC reports show which IPs are sending email so you know what to include
  • Change monitoring: Get alerted if your SPF record changes unexpectedly