What SPF checks, how to read a record, and the pitfalls that quietly break it.
What SPF Is
Sender Policy Framework (SPF) is a DNS TXT record that lists the servers authorized to send email for your domain. When a message arrives, the receiving server looks up your SPF record and checks whether the sending server is on the list. If it is not, SPF fails.
What SPF Actually Checks
SPF validates the return-path (also called the bounce address, envelope-from or MailFrom5321) - not the From address your recipient sees. This distinction matters: a message can pass SPF on a return-path you don't recognize while still spoofing your visible From. That gap is exactly why DMARC adds alignment on top.
An Example Record
| Host | Type | Value |
|---|---|---|
@ | TXT | v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all |
Read it as: version 1; authorize Google and Microsoft's servers; fail everything else (-all). Use -all (hard fail) once you are confident every legitimate source is listed; ~all (soft fail) is a safer interim.
Common Pitfalls
The 10-lookup limit. SPF allows at most 10 DNS lookups; too many include: statements breaks the record. Multiple SPF records. You may publish only one - merge them. Forgetting a sender. Any service that sends as your domain (CRM, help desk, invoicing) must be included or its mail fails SPF.
Frequently Asked Questions
What is SPF in email?
What does SPF check - the From address or the return-path?
What is the SPF 10-lookup limit?
Emails landing in spam?
Henry Timmes diagnoses why your mail isn't reaching the inbox - Microsoft 365, Gmail, Yahoo and beyond - and maps a practical fix. Book a free 15-minute call, no obligation.
Book a free consultation