{"id":74433,"date":"2023-09-07T17:54:51","date_gmt":"2023-09-07T17:54:51","guid":{"rendered":"https:\/\/mailrelay.com\/glosario\/spf-sender-policy-framework\/"},"modified":"2026-10-07T00:37:11","modified_gmt":"2026-10-07T00:37:11","slug":"spf-sender-policy-framework","status":"publish","type":"glossary","link":"https:\/\/mailrelay.com\/en\/glossary\/spf-sender-policy-framework\/","title":{"rendered":"SPF (Sender Policy Framework)"},"content":{"rendered":"\n

SPF (Sender Policy Framework) is a DNS record that specifies which servers can send emails on behalf of your domain.<\/strong> When an email arrives, the receiving server checks that list. If the sender isn’t on it, the server gets suspicious.<\/p>\n\n

Think of a party’s guest list. Whoever is on it gets in; whoever isn’t stays at the door or is let in with caution.<\/p>\n\n

Without that list, anyone could send emails pretending to be your company.<\/p>\n\n

What is SPF?<\/h2>\n\n

It is an email authentication standard defined in RFC 7208 (2014). It is published as a TXT record in your domain’s DNS and always starts with v=spf1.<\/p>\n\n

Its goal is to stop sender spoofing.<\/strong> It is one of the three pillars of email authentication<\/a>, along with DKIM<\/a> and DMARC<\/a>.<\/p>\n\n

How does SPF work?<\/h2>\n\n

The check takes seconds, every time a server receives an email.<\/p>\n\n

\"How<\/figure>\n\n

1. Your server sends the email<\/h3>\n\n

The message leaves from a specific IP: that of your mail server or that of your email marketing platform.<\/p>\n\n

2. The receiver looks at the technical sender’s domain<\/h3>\n\n

It reads the domain of the return address (Return-Path), the one that receives bounces. It isn’t always the same one the recipient sees in the “From” field.<\/p>\n\n

3. It checks the record in your DNS<\/h3>\n\n

It looks for the TXT record starting with v=spf1 on that domain and gets the list of authorized servers.<\/p>\n\n

4. It compares the IP and decides<\/h3>\n\n

If the IP is on the list, the result is spf=pass<\/strong>. If it isn’t, the result depends on how your record ends: fail, softfail or neutral.<\/p>\n\n

What an SPF record looks like<\/h2>\n\n

A typical example:<\/p>\n\n

v=spf1 a mx include:spf.ipzmarketing.com -all<\/p>\n\n

Each part has a meaning:<\/p>\n\n

Part<\/th>What it indicates<\/th>Example<\/th><\/tr><\/thead>
v=spf1<\/td>Version (required, always at the start)<\/td>v=spf1<\/td><\/tr>
a<\/td>Authorizes the domain’s IP<\/td>a<\/td><\/tr>
mx<\/td>Authorizes the domain’s mail servers<\/td>mx<\/td><\/tr>
ip4 \/ ip6<\/td>Authorizes a specific IP or range<\/td>ip4:192.0.2.10<\/td><\/tr>
include<\/td>Authorizes another provider’s servers<\/td>include:provider-domain.com<\/td><\/tr>
all<\/td>What to do with everything else (always at the end)<\/td>-all<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

What -all, ~all and ?all mean<\/h2>\n\n

The end of the record tells the receiver what to do with servers that aren’t on your list:<\/p>\n\n

Ending<\/th>Result<\/th>What the receiver usually does<\/th><\/tr><\/thead>
-all<\/td>Fail<\/td>Reject the email or send it to spam<\/td><\/tr>
~all<\/td>Softfail (soft failure)<\/td>Accept it, but flag it as suspicious<\/td><\/tr>
?all<\/td>Neutral<\/td>Ignore the result<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

If all your sending services are already on the list, use -all.<\/strong> If you’re not sure, start with ~all and review your sends before tightening it. Avoid +all: it authorizes any server in the world.<\/p>\n\n

Why is this so important?<\/h2>\n\n

Because the major providers already require it.<\/strong> Since February 2024, Gmail and Yahoo require SPF or DKIM from all senders, and all three protocols from anyone sending more than 5,000 emails a day. Microsoft has applied similar requirements in Outlook since May 2025.<\/p>\n\n

It also protects your domain from phishing and improves your deliverability<\/a>. A domain without this record is easier to spoof and inspires less trust.<\/p>\n\n

That said, it has two limitations. It checks the Return-Path, not the visible “From”, and it fails when another server forwards the email. That’s why it’s combined with DKIM and DMARC.<\/p>\n\n

\n

Authenticate your domain and reach the inbox<\/strong><\/p>\n\n\n\n

Set up SPF, DKIM and DMARC in Mailrelay and send up to 80,000 emails a month for free to 20,000 contacts.<\/p>\n\n\n\n

\n
Create a free account<\/a><\/div>\n<\/div>\n<\/div><\/div>\n\n

How to create an SPF record step by step<\/h2>\n\n

All you need is access to your domain’s DNS panel and the list of services that send on your behalf.<\/p>\n\n

1. List who sends with your domain<\/h3>\n\n

Include your business email, your email marketing platform, your CRM, your online store or your invoicing tool.<\/p>\n\n

2. Gather each provider’s include<\/h3>\n\n

Each service gives you theirs in its help docs. You’ll find Mailrelay’s at the end of this page.<\/p>\n\n

3. Create or edit the TXT record in your DNS<\/h3>\n\n

Write a single record with all of them and end it with -all or ~all. If you already have one, add the new include; don’t create another one.<\/p>\n\n

4. Check that it works<\/h3>\n\n

Send yourself an email to Gmail and open “Show original”. You should see SPF: PASS<\/strong>. You can also use tools like MXToolbox.<\/p>\n\n

Common mistakes when setting it up<\/h2>\n\n

The most common one is having two records of this type on the same domain.<\/strong> Receivers treat this as an error and the check fails.<\/p>\n\n

Other common mistakes:<\/p>\n\n