What is SPF? Sender Policy Framework (SPF) explained

What is SPF? Sender Policy Framework (SPF) is an email authentication method created to prevent email spoofing. It does this by allowing domain owners to specify which email servers are authorized to send email on behalf of their domain. This is achieved by publishing a special TXT record – known as an SPF record – in the DNS. A record will typically have the following structure: Here is an example of what a record might look like: Each part of the record plays a specific role in defining the domain’s email-sending policies. Below, we explain what makes up the record.

Mechanisms in SPF records

SPF records use a set of mechanisms to define which email servers are authorized to send email on behalf of a domain. These mechanisms decide how the receiving email server validates the sender’s IP address. The most commonly used mechanisms include:

• ip4 & ip6: Specifies authorized IPv4 and IPv6 addresses.
• a: Authorizes any IP address associated with the domain’s A or AAAA DNS records.
• mx: Authorizes IP addresses of the domain’s Mail Exchange (MX) servers.
• include: References the SPF record of another domain. This is commonly used when third-party providers are authorized to send emails on behalf of the domain.

Qualifiers in SPF records

Qualifiers determine how the receiving server should handle emails that don’t match the specified mechanisms:

• +all: Pass (the email is accepted even if it doesn’t match any mechanism)
• -all: Fail (the email is rejected if it doesn’t match any mechanism)
• ~all: Softfail (the email is accepted but marked as suspicious if it doesn’t match any mechanism)
• ?all: Neutral (the email isn’t accepted or rejected – this qualifier treats the message as if there’s no SPF policy)

Modifiers in SPF records

Modifiers in SPF records provide extra functionality. They help enhance the flexibility and clarity of SPF policies. The two commonly used modifiers are:

1. redirect: Redirects the SPF check to another domain’s policy. This is useful when a domain’s email policy is fully managed by another domain.
2. exp: Defines a custom message that can be shown when an SPF check fails, helping explain why the email was rejected.