What SPF Does
SPF (Sender Policy Framework) is a TXT record that lists which mail servers are permitted to send email claiming to be from your domain. When a receiving server gets a message, it checks the sending server’s IP against the SPF record for the domain in the message envelope. If the IP isn’t listed, SPF fails.
It’s a domain-wide allowlist, published once and checked on every incoming message.
A Basic SPF Record
example.com. TXT "v=spf1 mx a ip4:203.0.113.10 -all"Reading this left to right:
- v=spf1 – version tag.
- mx – allow any server listed in the domain’s MX records to send mail.
- a – allow any server matching the domain’s A record.
- ip4:203.0.113.10 – explicitly allow this IP (perhaps an on-prem mail relay).
- -all – a hard fail: anything not matched above should be rejected. The alternatives are
~all(soft fail – mark as suspicious but usually still deliver) and+all(allow everything, which defeats the purpose entirely).
Including Third-Party Senders
Most domains send mail through more than just their own servers – Google Workspace, Microsoft 365, a marketing platform, a helpdesk tool. Each of these publishes its own SPF fragment that you pull in with include:
example.com. TXT "v=spf1 include:_spf.google.com include:sendgrid.net -all"Every one of these includes is a live DNS lookup at check time, which leads to SPF’s most common failure mode.
The 10-Lookup Limit
SPF permits a maximum of 10 DNS lookups per check – this covers include, a, mx, ptr, and exists mechanisms, including nested ones inside another provider’s include. Go over 10, and the entire SPF check returns a permanent error, which most receivers treat as an outright fail.
This is easy to hit by accident: adding a fourth or fifth SaaS tool that each pull in their own nested includes. Tools like a SPF flattening service or a manual lookup count are worth running whenever you add a new sender.
Only One SPF Record Per Domain
A domain can only have a single SPF TXT record. If you find two, merge them into one – having both is invalid per the spec and receivers may reject mail entirely or pick unpredictably between them:
# Wrong - two separate records
example.com. TXT "v=spf1 include:_spf.google.com -all"
example.com. TXT "v=spf1 include:sendgrid.net -all"
# Right - merged into one
example.com. TXT "v=spf1 include:_spf.google.com include:sendgrid.net -all"Why SPF Alone Isn’t Enough
SPF checks the envelope sender (the technical “MAIL FROM” address), not the visible From header the recipient sees. An attacker can pass SPF for their own domain while forging the display name and From address to look like yours. That’s exactly why DMARC – covered in the last post in this series – layers alignment checking on top, requiring the SPF-passing domain to actually match what the recipient sees.
Next up: CNAME records, a much simpler piece of DNS used for aliasing one hostname to another.
Leave a Reply
You must be logged in to post a comment.