SPF
Sender Policy Framework: a DNS record in which a domain lists the servers allowed to send mail for it, so a receiver can check the connecting IP address.
What it means
SPF lets a domain owner publish, in a TXT record, the IP addresses and hosts that may send mail for the domain. A receiving server takes the domain from the SMTP MAIL FROM command (or from HELO when the envelope sender is empty), fetches that domain's record and tests the connecting IP address against it. The answer is one of seven results, from pass to permerror.
SPF checks the envelope sender, which readers never see. The From address in the message is a separate field, so an SPF pass alone says nothing about who wrote the message. DMARC closes that gap by requiring the SPF domain to align with the From domain. SPF also fails on plain forwarding, because the forwarding server's address is not in the original sender's record.
The current specification is RFC 7208 (2014), which replaced the experimental RFC 4408. Gmail and Yahoo require SPF or DKIM from every sender, and both from bulk senders.
Example
example.com. 3600 IN TXT "v=spf1 ip4:192.0.2.0/24 include:_spf.mailhost.example -all"Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- RFC 7208: Sender Policy Framework (SPF)rfc-editor.org
- Google: Email sender guidelinessupport.google.com
- Yahoo Sender Hub: Sender best practicessenders.yahooinc.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes