All questions
Q & A Email Auth · August 12, 2026

Does SPF protect the From: address users see?

SPF checks the envelope sender (Return-Path / MAIL FROM), not the From: header that users see. Attackers can pass SPF on the envelope address while forging the From: header. DMARC alignment is what ties SPF to the From: header — requiring the envelope sender domain to match the From: domain.

Read the full guide
What Is an SPF Record? Sender Policy Framework Explained
SPF tells the world which servers are allowed to send email on behalf of your domain. A missing or misconfigured SPF record lets spammers forge your address — and sends your legitimate email straight to spam.
Related questions
Can I have two SPF records? How do I combine SPF for multiple email providers? How do I set up SPF for Google Workspace? How do I set up SPF for Microsoft 365? How do I set up SPF for Zoho Mail?