SPF (Sender Policy Framework) is a DNS-based email authentication mechanism. It lets domain owners publish a list of IP addresses and services authorized to send email on their behalf. Receiving mail servers check the sending IP against this list when processing inbound mail.
DNS Record Format
example.com. TXT "v=spf1 ip4:203.0.113.0/24 include:_spf.google.com ~all"Mechanisms
| Mechanism | Example | Matches |
|---|---|---|
ip4: | ip4:203.0.113.0/24 | IPv4 address or CIDR range |
include: | include:_spf.google.com | All IPs in another domain’s SPF |
mx | mx | Domain’s mail server IPs |
all | ~all / -all | Catch-all (always last) |
All Qualifier
~all(SoftFail): flag but deliver-all(Fail): reject unauthorized senders?all(Neutral): no policy — useless for security
Key Limitation
SPF checks the envelope sender (MAIL FROM / Return-Path), not the From: header users see. Attackers can pass SPF while forging the visible From: address. DMARC alignment is required to tie SPF results to the From: header.
10-Lookup Limit
RFC 7208 limits SPF evaluation to 10 DNS lookups. Exceeding this causes a PermError. Use ip4:/ip6: instead of include: chains where possible.