What is SPF?

SPF, or Sender Policy Framework, is a DNS TXT record that lists the services allowed to send email for a domain. When a receiving mail server gets a message, it can compare the sending server against the SPF record published by the domain in the envelope sender.

A typical SPF record starts with v=spf1, includes one or more approved senders, and ends with an all mechanism such as ~all or -all. That final mechanism tells receivers how strongly to treat mail from servers that are not listed.

Without SPF, attackers can more easily send mail that appears to come from your domain. SPF gives receivers a machine-readable way to reject or downgrade messages sent from unapproved infrastructure.

SPF also protects legitimate delivery. If your record is missing a sender such as Google Workspace, Microsoft 365, HubSpot, Klaviyo, or SendGrid, valid campaigns and transactional mail can fail authentication.

The most common SPF problems are multiple SPF records, missing senders, records that exceed the 10 DNS lookup limit, and overly loose mechanisms such as +all. Any of those can weaken spoofing protection or break legitimate delivery.

Review SPF whenever you add or remove an email platform. A clean record should include every active sender and avoid stale includes from services you no longer use.